Edit tour

Windows Analysis Report
2ZsJ2iP8Q2.exe

Overview

General Information

Sample name:	2ZsJ2iP8Q2.exe renamed because original name is a hash value
Original sample name:	7884feeb676b85c98dbbe6a0e6f92cbc.exe
Analysis ID:	1579789
MD5:	7884feeb676b85c98dbbe6a0e6f92cbc
SHA1:	897b3e60a77b96d2423525a6db8ccb386abeb14d
SHA256:	80e820374e64aba34f70f88c5d7d3ecf7967d833d1ab674d50379ee4034a30d0
Tags:	exeLummaStealeruser-abuse_ch
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

PE file contains section with special chars

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Detected potential crypto function

Entry point lies outside standard sections

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

2ZsJ2iP8Q2.exe (PID: 4468 cmdline: "C:\Users\user\Desktop\2ZsJ2iP8Q2.exe" MD5: 7884FEEB676B85C98DBBE6A0E6F92CBC)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["necklacebudi.lat", "rapeflowwj.lat", "discokeyus.lat", "energyaffai.lat", "sweepyribs.lat", "crosshuaht.lat", "sustainskelet.lat", "aspecteirs.lat", "grannyejh.lat"], "Build id": "PsFKDg--pablo"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T09:09:36.670378+0100	2028371	3	Unknown Traffic	192.168.2.8	49706	104.102.49.254	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (aspecteirs .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T09:09:34.068057+0100	2058354	1	Domain Observed Used for C2 Detected	192.168.2.8	63285	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crosshuaht .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T09:09:34.600987+0100	2058358	1	Domain Observed Used for C2 Detected	192.168.2.8	49676	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (discokeyus .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T09:09:33.262726+0100	2058360	1	Domain Observed Used for C2 Detected	192.168.2.8	64751	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (energyaffai .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T09:09:33.845893+0100	2058362	1	Domain Observed Used for C2 Detected	192.168.2.8	60902	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grannyejh .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T09:09:32.999917+0100	2058364	1	Domain Observed Used for C2 Detected	192.168.2.8	56783	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacebudi .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T09:09:33.566723+0100	2058370	1	Domain Observed Used for C2 Detected	192.168.2.8	61074	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (rapeflowwj .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T09:09:34.821764+0100	2058374	1	Domain Observed Used for C2 Detected	192.168.2.8	64576	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sustainskelet .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T09:09:34.378734+0100	2058376	1	Domain Observed Used for C2 Detected	192.168.2.8	57790	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T09:09:32.847068+0100	2058378	1	Domain Observed Used for C2 Detected	192.168.2.8	64051	1.1.1.1	53	UDP

ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T09:09:37.621179+0100	2858666	1	Domain Observed Used for C2 Detected	192.168.2.8	49706	104.102.49.254	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 2ZsJ2iP8Q2.exe

Avira: detected

Found malware configuration

Source: 2ZsJ2iP8Q2.exe.4468.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["necklacebudi.lat", "rapeflowwj.lat", "discokeyus.lat", "energyaffai.lat", "sweepyribs.lat", "crosshuaht.lat", "sustainskelet.lat", "aspecteirs.lat", "grannyejh.lat"], "Build id": "PsFKDg--pablo"}

Multi AV Scanner detection for submitted file

Source: 2ZsJ2iP8Q2.exe	ReversingLabs: Detection: 57%
Source: 2ZsJ2iP8Q2.exe	Virustotal: Detection: 53%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: 2ZsJ2iP8Q2.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000003.1404239657.0000000004C50000.00000004.00001000.00020000.00000000.sdmp	String decryptor: rapeflowwj.lat
Source: 00000000.00000003.1404239657.0000000004C50000.00000004.00001000.00020000.00000000.sdmp	String decryptor: crosshuaht.lat
Source: 00000000.00000003.1404239657.0000000004C50000.00000004.00001000.00020000.00000000.sdmp	String decryptor: sustainskelet.lat
Source: 00000000.00000003.1404239657.0000000004C50000.00000004.00001000.00020000.00000000.sdmp	String decryptor: aspecteirs.lat
Source: 00000000.00000003.1404239657.0000000004C50000.00000004.00001000.00020000.00000000.sdmp	String decryptor: energyaffai.lat
Source: 00000000.00000003.1404239657.0000000004C50000.00000004.00001000.00020000.00000000.sdmp	String decryptor: necklacebudi.lat
Source: 00000000.00000003.1404239657.0000000004C50000.00000004.00001000.00020000.00000000.sdmp	String decryptor: discokeyus.lat
Source: 00000000.00000003.1404239657.0000000004C50000.00000004.00001000.00020000.00000000.sdmp	String decryptor: grannyejh.lat
Source: 00000000.00000003.1404239657.0000000004C50000.00000004.00001000.00020000.00000000.sdmp	String decryptor: sweepyribs.lat
Source: 00000000.00000003.1404239657.0000000004C50000.00000004.00001000.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000003.1404239657.0000000004C50000.00000004.00001000.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000003.1404239657.0000000004C50000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000003.1404239657.0000000004C50000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000003.1404239657.0000000004C50000.00000004.00001000.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000003.1404239657.0000000004C50000.00000004.00001000.00020000.00000000.sdmp	String decryptor: PsFKDg--pablo

Source: 2ZsJ2iP8Q2.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.8:49706 version: TLS 1.2

Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 4x nop then movzx esi, byte ptr [ebp+ebx-10h]	0_2_00FEC767
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 4x nop then lea edx, dword ptr [ecx+01h]	0_2_00FBB70C
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 4x nop then mov edx, ecx	0_2_00FB9C4A
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 4x nop then push C0BFD6CCh	0_2_00FD3086
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 4x nop then push C0BFD6CCh	0_2_00FD3086
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 4x nop then mov word ptr [ecx], dx	0_2_00FD91DD
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 4x nop then mov ecx, dword ptr [ebp-20h]	0_2_00FD91DD
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], E5FE86B7h	0_2_00FEB1D0
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 4x nop then mov ebx, eax	0_2_00FEB1D0
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 4x nop then mov ebx, esi	0_2_00FD2190
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 4x nop then mov word ptr [ebx], cx	0_2_00FD2190
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 4x nop then cmp word ptr [edi+eax+02h], 0000h	0_2_00FD2190
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 4x nop then add ebp, dword ptr [esp+0Ch]	0_2_00FDB170
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 4x nop then mov word ptr [ebx], ax	0_2_00FCB2E0
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax-7D4F867Fh]	0_2_00FC6263
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+61D008CBh]	0_2_00FC5220
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx-7D4F867Fh]	0_2_00FC7380
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 4x nop then cmp word ptr [ebx+edi+02h], 0000h	0_2_00FCD380
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax]	0_2_00FEF330
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	0_2_00FB74F0
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	0_2_00FB74F0
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 4x nop then mov word ptr [ecx], dx	0_2_00FD91DD
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 4x nop then mov ecx, dword ptr [ebp-20h]	0_2_00FD91DD
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx-7D4F867Fh]	0_2_00FC7380
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	0_2_00FE5450
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 9C259492h	0_2_00FE85E0
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 4x nop then jmp eax	0_2_00FE85E0
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 4x nop then xor edi, edi	0_2_00FC759F
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 4x nop then jmp dword ptr [00FF450Ch]	0_2_00FC8591
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 4x nop then mov ecx, eax	0_2_00FB9580
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 4x nop then mov word ptr [ebp+00h], ax	0_2_00FB9580
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 4x nop then mov eax, dword ptr [00FF473Ch]	0_2_00FCC653
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+423C9D38h]	0_2_00FCE7C0
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 4x nop then movzx eax, word ptr [edx]	0_2_00FC97C2
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 4x nop then mov word ptr [edi], dx	0_2_00FC97C2
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 4x nop then mov word ptr [esi], cx	0_2_00FC97C2
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 4x nop then mov esi, eax	0_2_00FC5799
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 4x nop then mov ecx, eax	0_2_00FC5799
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	0_2_00FDA700
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-0Dh]	0_2_00FD3860
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 4x nop then jmp eax	0_2_00FD984F
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 4x nop then mov word ptr [ecx], bp	0_2_00FCD83A
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_00FC682D
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+18h]	0_2_00FC682D
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+ecx-75h]	0_2_00FC682D
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 4x nop then mov edx, ecx	0_2_00FE8810
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 4x nop then cmp dword ptr [edi+ebp*8], 5E874B5Fh	0_2_00FE8810
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 4x nop then cmp dword ptr [edx+edi*8], BC9C9AFCh	0_2_00FE8810
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 4x nop then test eax, eax	0_2_00FE8810
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 4x nop then mov eax, dword ptr [esp+00000080h]	0_2_00FC79C1
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 4x nop then mov ebx, eax	0_2_00FB5990
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 4x nop then mov ebp, eax	0_2_00FB5990
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 4x nop then mov byte ptr [edi], cl	0_2_00FDCAD0
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 4x nop then push esi	0_2_00FD7AD3
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 4x nop then push ebx	0_2_00FECA93
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 4x nop then mov byte ptr [esi], al	0_2_00FDDA53
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 4x nop then mov byte ptr [edi], cl	0_2_00FDCA49
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 4x nop then mov ebx, eax	0_2_00FBDBD9
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 4x nop then mov ebx, eax	0_2_00FBDBD9
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 4x nop then cmp al, 2Eh	0_2_00FD6B95
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_00FD8B61
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_00FCCB40
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 4x nop then mov word ptr [esi], cx	0_2_00FCCB40
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 4x nop then mov byte ptr [edi], cl	0_2_00FDCB22
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 4x nop then mov byte ptr [edi], cl	0_2_00FDCB11
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+68E75405h]	0_2_00FEECA0
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 4x nop then push 00000000h	0_2_00FD9C2B
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 4x nop then movzx edi, byte ptr [esp+ecx-7D4F88C7h]	0_2_00FC7DEE
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 4x nop then mov eax, dword ptr [ebp-68h]	0_2_00FD8D93
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 4x nop then mov ecx, eax	0_2_00FEAEC0
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 4x nop then mov edx, ebp	0_2_00FD5E70
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 4x nop then jmp dword ptr [00FF55F4h]	0_2_00FD5E30
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 4x nop then jmp ecx	0_2_00FBBFFD
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 4x nop then mov ecx, ebx	0_2_00FDDFE9
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+68E75405h]	0_2_00FEEFB0
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 4x nop then xor byte ptr [esp+eax+17h], al	0_2_00FB8F50
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 4x nop then mov byte ptr [edi], bl	0_2_00FB8F50
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 4x nop then mov eax, dword ptr [ebx+edi+44h]	0_2_00FC9F30
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 4x nop then mov byte ptr [esi], al	0_2_00FCBF14

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2058360 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (discokeyus .lat) : 192.168.2.8:64751 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058378 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat) : 192.168.2.8:64051 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058364 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grannyejh .lat) : 192.168.2.8:56783 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058370 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacebudi .lat) : 192.168.2.8:61074 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058362 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (energyaffai .lat) : 192.168.2.8:60902 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058376 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sustainskelet .lat) : 192.168.2.8:57790 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058358 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crosshuaht .lat) : 192.168.2.8:49676 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058374 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (rapeflowwj .lat) : 192.168.2.8:64576 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058354 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (aspecteirs .lat) : 192.168.2.8:63285 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.8:49706 -> 104.102.49.254:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: necklacebudi.lat
Source: Malware configuration extractor	URLs: rapeflowwj.lat
Source: Malware configuration extractor	URLs: discokeyus.lat
Source: Malware configuration extractor	URLs: energyaffai.lat
Source: Malware configuration extractor	URLs: sweepyribs.lat
Source: Malware configuration extractor	URLs: crosshuaht.lat
Source: Malware configuration extractor	URLs: sustainskelet.lat
Source: Malware configuration extractor	URLs: aspecteirs.lat
Source: Malware configuration extractor	URLs: grannyejh.lat

Source: Joe Sandbox View

IP Address: 104.102.49.254 104.102.49.254

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic

Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49706 -> 104.102.49.254:443

Source: global traffic

HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

Source: 2ZsJ2iP8Q2.exe, 00000000.00000002.1491103778.0000000000B75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: 2ZsJ2iP8Q2.exe, 00000000.00000002.1490977315.0000000000B37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=Nonesessionid=08097025d33d9dd43aaddf04; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type25665Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveMon, 23 Dec 2024 08:09:37 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-Controlk equals www.youtube.com (Youtube)
Source: 2ZsJ2iP8Q2.exe, 00000000.00000002.1490977315.0000000000B37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: sweepyribs.lat
Source: global traffic	DNS traffic detected: DNS query: grannyejh.lat
Source: global traffic	DNS traffic detected: DNS query: discokeyus.lat
Source: global traffic	DNS traffic detected: DNS query: necklacebudi.lat
Source: global traffic	DNS traffic detected: DNS query: energyaffai.lat
Source: global traffic	DNS traffic detected: DNS query: aspecteirs.lat
Source: global traffic	DNS traffic detected: DNS query: sustainskelet.lat
Source: global traffic	DNS traffic detected: DNS query: crosshuaht.lat
Source: global traffic	DNS traffic detected: DNS query: rapeflowwj.lat
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com

Source: 2ZsJ2iP8Q2.exe, 00000000.00000002.1490977315.0000000000B37000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000002.1491103778.0000000000B75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: 2ZsJ2iP8Q2.exe, 00000000.00000003.1456091842.0000000000AFB000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: 2ZsJ2iP8Q2.exe, 00000000.00000003.1456091842.0000000000AFB000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: 2ZsJ2iP8Q2.exe, 00000000.00000003.1456091842.0000000000AFB000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: 2ZsJ2iP8Q2.exe, 00000000.00000002.1491103778.0000000000B75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: 2ZsJ2iP8Q2.exe, 00000000.00000002.1490977315.0000000000B37000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000002.1491103778.0000000000B75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: 2ZsJ2iP8Q2.exe, 00000000.00000002.1490977315.0000000000B37000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000002.1491103778.0000000000B75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/
Source: 2ZsJ2iP8Q2.exe, 00000000.00000002.1491103778.0000000000B75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: 2ZsJ2iP8Q2.exe, 00000000.00000002.1491103778.0000000000B75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/
Source: 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B84000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000002.1490892168.0000000000AF9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=Lj6X7NKUMfzk&a
Source: 2ZsJ2iP8Q2.exe, 00000000.00000003.1456329603.0000000000B75000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000002.1491103778.0000000000B75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_c
Source: 2ZsJ2iP8Q2.exe, 00000000.00000003.1456329603.0000000000B75000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000002.1491103778.0000000000B75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/fatalerror.css?v=OFUqlcDNiD6y&l=engli
Source: 2ZsJ2iP8Q2.exe, 00000000.00000003.1456329603.0000000000B75000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000002.1491103778.0000000000B75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a
Source: 2ZsJ2iP8Q2.exe, 00000000.00000003.1456091842.0000000000AFB000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: 2ZsJ2iP8Q2.exe, 00000000.00000003.1456091842.0000000000AFB000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: 2ZsJ2iP8Q2.exe, 00000000.00000003.1456091842.0000000000AFB000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=_92TWn81
Source: 2ZsJ2iP8Q2.exe, 00000000.00000003.1456091842.0000000000AFB000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=hyEE
Source: 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am
Source: 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=gQHVlrK4-jX-&l
Source: 2ZsJ2iP8Q2.exe, 00000000.00000003.1456329603.0000000000B75000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000002.1491103778.0000000000B75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng
Source: 2ZsJ2iP8Q2.exe, 00000000.00000003.1456329603.0000000000B75000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000002.1491103778.0000000000B75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC
Source: 2ZsJ2iP8Q2.exe, 00000000.00000003.1456329603.0000000000B75000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000002.1491103778.0000000000B75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&
Source: 2ZsJ2iP8Q2.exe, 00000000.00000003.1456329603.0000000000B75000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000002.1491103778.0000000000B75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl
Source: 2ZsJ2iP8Q2.exe, 00000000.00000003.1456329603.0000000000B75000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000002.1491103778.0000000000B75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=wuA4X_n5-mo0&l=en
Source: 2ZsJ2iP8Q2.exe, 00000000.00000003.1456329603.0000000000B75000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000002.1491103778.0000000000B75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&
Source: 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6QbwI-5-j2S&amp
Source: 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am
Source: 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=tvQ
Source: 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en
Source: 2ZsJ2iP8Q2.exe, 00000000.00000002.1491103778.0000000000B75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: 2ZsJ2iP8Q2.exe, 00000000.00000002.1491103778.0000000000B75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: 2ZsJ2iP8Q2.exe, 00000000.00000002.1490977315.0000000000B37000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000002.1491103778.0000000000B75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: 2ZsJ2iP8Q2.exe, 00000000.00000002.1490977315.0000000000B37000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000002.1491103778.0000000000B75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: 2ZsJ2iP8Q2.exe, 00000000.00000002.1490977315.0000000000B37000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000002.1491103778.0000000000B75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: 2ZsJ2iP8Q2.exe, 00000000.00000002.1490977315.0000000000B37000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000002.1491103778.0000000000B75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: 2ZsJ2iP8Q2.exe, 00000000.00000002.1490977315.0000000000B37000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000002.1491103778.0000000000B75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: 2ZsJ2iP8Q2.exe, 00000000.00000002.1490977315.0000000000B37000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000002.1491103778.0000000000B75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: 2ZsJ2iP8Q2.exe, 00000000.00000002.1490977315.0000000000B37000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000002.1491103778.0000000000B75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: 2ZsJ2iP8Q2.exe, 00000000.00000002.1490977315.0000000000B37000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000002.1491103778.0000000000B75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: 2ZsJ2iP8Q2.exe, 00000000.00000002.1490977315.0000000000B37000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000002.1491103778.0000000000B75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: 2ZsJ2iP8Q2.exe, 00000000.00000002.1490977315.0000000000B37000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000002.1491103778.0000000000B75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: 2ZsJ2iP8Q2.exe, 00000000.00000002.1490977315.0000000000B37000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000002.1491103778.0000000000B75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: 2ZsJ2iP8Q2.exe, 00000000.00000003.1456091842.0000000000AFB000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com
Source: 2ZsJ2iP8Q2.exe, 00000000.00000002.1490977315.0000000000B37000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000002.1491103778.0000000000B75000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000002.1490977315.0000000000B02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: 2ZsJ2iP8Q2.exe, 00000000.00000003.1456329603.0000000000B75000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000002.1491103778.0000000000B75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/0E1
Source: 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: 2ZsJ2iP8Q2.exe, 00000000.00000003.1456329603.0000000000B75000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000002.1491103778.0000000000B75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/com1
Source: 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: 2ZsJ2iP8Q2.exe, 00000000.00000003.1456091842.0000000000AFB000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: 2ZsJ2iP8Q2.exe, 00000000.00000003.1456091842.0000000000B02000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000002.1490977315.0000000000B1B000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456091842.0000000000B1B000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000002.1490977315.0000000000B02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: 2ZsJ2iP8Q2.exe, 00000000.00000002.1491103778.0000000000B75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: 2ZsJ2iP8Q2.exe, 00000000.00000003.1456329603.0000000000B75000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456091842.0000000000B37000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000002.1490977315.0000000000B37000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000002.1491103778.0000000000B75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: 2ZsJ2iP8Q2.exe, 00000000.00000003.1456091842.0000000000B37000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000002.1490977315.0000000000B37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C185ce35c568ebbb
Source: 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: 2ZsJ2iP8Q2.exe, 00000000.00000003.1456091842.0000000000AFB000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shopU
Source: 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: 2ZsJ2iP8Q2.exe, 00000000.00000002.1490977315.0000000000B37000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000002.1491103778.0000000000B75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: 2ZsJ2iP8Q2.exe, 00000000.00000002.1491103778.0000000000B75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: 2ZsJ2iP8Q2.exe, 00000000.00000002.1490977315.0000000000B37000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000002.1491103778.0000000000B75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: 2ZsJ2iP8Q2.exe, 00000000.00000002.1490977315.0000000000B37000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000002.1491103778.0000000000B75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: 2ZsJ2iP8Q2.exe, 00000000.00000003.1456091842.0000000000AFB000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: 2ZsJ2iP8Q2.exe, 00000000.00000002.1490977315.0000000000B37000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000002.1491103778.0000000000B75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: 2ZsJ2iP8Q2.exe, 00000000.00000002.1490977315.0000000000B37000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000002.1491103778.0000000000B75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706

Source: unknown

HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.8:49706 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: 2ZsJ2iP8Q2.exe	Static PE information: section name:
Source: 2ZsJ2iP8Q2.exe	Static PE information: section name: .idata
Source: 2ZsJ2iP8Q2.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_00FB8850	0_2_00FB8850
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_00FBACF0	0_2_00FBACF0
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010A410C	0_2_010A410C
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0104D109	0_2_0104D109
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010BC115	0_2_010BC115
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0103612B	0_2_0103612B
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010B913C	0_2_010B913C
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01042141	0_2_01042141
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01087142	0_2_01087142
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0105814B	0_2_0105814B
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0107A15C	0_2_0107A15C
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010D0152	0_2_010D0152
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01076165	0_2_01076165
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0108517C	0_2_0108517C
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01095188	0_2_01095188
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010B118D	0_2_010B118D
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0104F18E	0_2_0104F18E
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0109D191	0_2_0109D191
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0104B19E	0_2_0104B19E
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0103C1A2	0_2_0103C1A2
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0108F1A9	0_2_0108F1A9
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010601A2	0_2_010601A2
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010BD1A1	0_2_010BD1A1
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0107F1AA	0_2_0107F1AA
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010C91B9	0_2_010C91B9
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010B01B5	0_2_010B01B5
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0107B1C0	0_2_0107B1C0
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010C41C5	0_2_010C41C5
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010201DC	0_2_010201DC
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0109E1E0	0_2_0109E1E0
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010371EF	0_2_010371EF
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010381F4	0_2_010381F4
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010941FE	0_2_010941FE
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010B61F1	0_2_010B61F1
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01048004	0_2_01048004
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0108A002	0_2_0108A002
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01090002	0_2_01090002
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01054009	0_2_01054009
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0104E018	0_2_0104E018
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_00FD91DD	0_2_00FD91DD
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0109B02D	0_2_0109B02D
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0108C021	0_2_0108C021
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_00FEB1D0	0_2_00FEB1D0
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0106B03E	0_2_0106B03E
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010BC032	0_2_010BC032
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_00FD41C0	0_2_00FD41C0
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_00FD31C2	0_2_00FD31C2
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01025047	0_2_01025047
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_00FB91B0	0_2_00FB91B0
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01068049	0_2_01068049
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010B3068	0_2_010B3068
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010C806F	0_2_010C806F
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01037067	0_2_01037067
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0106E060	0_2_0106E060
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_00FD2190	0_2_00FD2190
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010AB08B	0_2_010AB08B
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0101B083	0_2_0101B083
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0104A086	0_2_0104A086
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010AA08D	0_2_010AA08D
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0109809A	0_2_0109809A
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0105B09B	0_2_0105B09B
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0102D0A3	0_2_0102D0A3
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0108B0A3	0_2_0108B0A3
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010620B8	0_2_010620B8
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010140D0	0_2_010140D0
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010B60E2	0_2_010B60E2
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010CF0E6	0_2_010CF0E6
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010500F5	0_2_010500F5
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0106C0FF	0_2_0106C0FF
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0107C0FB	0_2_0107C0FB
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0106D0F8	0_2_0106D0F8
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0109C30E	0_2_0109C30E
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01015309	0_2_01015309
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0108F319	0_2_0108F319
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010AB31F	0_2_010AB31F
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_00FCB2E0	0_2_00FCB2E0
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010C5310	0_2_010C5310
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01046319	0_2_01046319
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01165336	0_2_01165336
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_00FD52DD	0_2_00FD52DD
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01056326	0_2_01056326
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0102632A	0_2_0102632A
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0107333E	0_2_0107333E
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0102C33D	0_2_0102C33D
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0108B34B	0_2_0108B34B
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0108A342	0_2_0108A342
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0103B358	0_2_0103B358
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0102235C	0_2_0102235C
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01083368	0_2_01083368
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010CA36C	0_2_010CA36C
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_00FCE290	0_2_00FCE290
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010A137B	0_2_010A137B
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01012374	0_2_01012374
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01023375	0_2_01023375
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0102137B	0_2_0102137B
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0107237E	0_2_0107237E
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_00FB6280	0_2_00FB6280
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01020388	0_2_01020388
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010AA39B	0_2_010AA39B
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010A739E	0_2_010A739E
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_00FC6263	0_2_00FC6263
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0109A3BF	0_2_0109A3BF
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010623BE	0_2_010623BE
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0100A3B9	0_2_0100A3B9
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010A43CC	0_2_010A43CC
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010653D6	0_2_010653D6
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0101E3D3	0_2_0101E3D3
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010843DB	0_2_010843DB
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010703DE	0_2_010703DE
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_00FC5220	0_2_00FC5220
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010253EC	0_2_010253EC
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010903E6	0_2_010903E6
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_00FDC3FC	0_2_00FDC3FC
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01088239	0_2_01088239
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0105C236	0_2_0105C236
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01069231	0_2_01069231
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010BB231	0_2_010BB231
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01045246	0_2_01045246
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010C824A	0_2_010C824A
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0105725D	0_2_0105725D
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01064258	0_2_01064258
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010B726A	0_2_010B726A
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0107D262	0_2_0107D262
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_00FD4380	0_2_00FD4380
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0105F28A	0_2_0105F28A
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0105A292	0_2_0105A292
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010AD297	0_2_010AD297
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010D1290	0_2_010D1290
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0104429B	0_2_0104429B
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010D22A3	0_2_010D22A3
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_00FED34D	0_2_00FED34D
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0104D2B1	0_2_0104D2B1
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010A82B4	0_2_010A82B4
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_00FDA33F	0_2_00FDA33F
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0101C2C3	0_2_0101C2C3
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010392C6	0_2_010392C6
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_00FB8330	0_2_00FB8330
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_00FEF330	0_2_00FEF330
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010D32C3	0_2_010D32C3
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010CD2DF	0_2_010CD2DF
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010AE2D3	0_2_010AE2D3
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_00FD5327	0_2_00FD5327
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_00FB4320	0_2_00FB4320
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_00FD830D	0_2_00FD830D
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0103E2F0	0_2_0103E2F0
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0102E2F4	0_2_0102E2F4
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010272F5	0_2_010272F5
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_00FB74F0	0_2_00FB74F0
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_00FD91DD	0_2_00FD91DD
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01096524	0_2_01096524
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0107A537	0_2_0107A537
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0104A535	0_2_0104A535
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0107D53E	0_2_0107D53E
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0106854F	0_2_0106854F
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0104C54F	0_2_0104C54F
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010C7559	0_2_010C7559
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0101C55A	0_2_0101C55A
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0107155A	0_2_0107155A
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0109E556	0_2_0109E556
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010B156A	0_2_010B156A
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0102A568	0_2_0102A568
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0104B569	0_2_0104B569
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01034572	0_2_01034572
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010BD57A	0_2_010BD57A
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_00FC148F	0_2_00FC148F
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01082588	0_2_01082588
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0107B585	0_2_0107B585
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01035585	0_2_01035585
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0107058B	0_2_0107058B
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010D1582	0_2_010D1582
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0103759F	0_2_0103759F
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010AB594	0_2_010AB594
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0103C5AB	0_2_0103C5AB
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0105A5AE	0_2_0105A5AE
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010405A8	0_2_010405A8
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010435AA	0_2_010435AA
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010785C7	0_2_010785C7
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010945C8	0_2_010945C8
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010A65D0	0_2_010A65D0
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0116E5C8	0_2_0116E5C8
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010515DA	0_2_010515DA
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010155E0	0_2_010155E0
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010C15E7	0_2_010C15E7
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0100F5ED	0_2_0100F5ED
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010C95FD	0_2_010C95FD
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010555F6	0_2_010555F6
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0103B5FC	0_2_0103B5FC
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010B3403	0_2_010B3403
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01036426	0_2_01036426
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0103D429	0_2_0103D429
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010CB449	0_2_010CB449
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0109744F	0_2_0109744F
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010A6447	0_2_010A6447
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01011455	0_2_01011455
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0105945B	0_2_0105945B
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_00FC759F	0_2_00FC759F
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0104E463	0_2_0104E463
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010CF462	0_2_010CF462
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0107B468	0_2_0107B468
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0109347F	0_2_0109347F
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010A347D	0_2_010A347D
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_00FB9580	0_2_00FB9580
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010BA477	0_2_010BA477
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0109D48C	0_2_0109D48C
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010B4491	0_2_010B4491
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0102F4A3	0_2_0102F4A3
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010674A1	0_2_010674A1
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0102B4AE	0_2_0102B4AE
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010B94A4	0_2_010B94A4
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010574B5	0_2_010574B5
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010484BB	0_2_010484BB
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010504C3	0_2_010504C3
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0106E4DF	0_2_0106E4DF
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010AF4EE	0_2_010AF4EE
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_00FD2510	0_2_00FD2510
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010144EC	0_2_010144EC
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0109F4FE	0_2_0109F4FE
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_00FE7500	0_2_00FE7500
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010794F8	0_2_010794F8
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010C6703	0_2_010C6703
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01076712	0_2_01076712
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0101371D	0_2_0101371D
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_00FD36E2	0_2_00FD36E2
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010A9715	0_2_010A9715
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0104D723	0_2_0104D723
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_00FD66D0	0_2_00FD66D0
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01051735	0_2_01051735
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010CD73D	0_2_010CD73D
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_00FD86C0	0_2_00FD86C0
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010AB749	0_2_010AB749
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0106F742	0_2_0106F742
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01012748	0_2_01012748
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0105D74F	0_2_0105D74F
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01092746	0_2_01092746
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0107A75C	0_2_0107A75C
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01061759	0_2_01061759
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01090768	0_2_01090768
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0108B764	0_2_0108B764
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010AE766	0_2_010AE766
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01026771	0_2_01026771
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010BB770	0_2_010BB770
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010AA78E	0_2_010AA78E
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01016795	0_2_01016795
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0106479C	0_2_0106479C
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0106979C	0_2_0106979C
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01099793	0_2_01099793
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010247AA	0_2_010247AA
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0103E7B4	0_2_0103E7B4
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010187BB	0_2_010187BB
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010C27CA	0_2_010C27CA
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010897D1	0_2_010897D1
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010217DC	0_2_010217DC
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010A57E9	0_2_010A57E9
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010CA7EA	0_2_010CA7EA
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010597EC	0_2_010597EC
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_00FD7603	0_2_00FD7603
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0102C609	0_2_0102C609
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010CB607	0_2_010CB607
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0101A60E	0_2_0101A60E
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0104E610	0_2_0104E610
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010D461B	0_2_010D461B
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0108062C	0_2_0108062C
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01030632	0_2_01030632
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010B563E	0_2_010B563E
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0104F63D	0_2_0104F63D
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_00FCE7C0	0_2_00FCE7C0
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_00FC97C2	0_2_00FC97C2
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010C864B	0_2_010C864B
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0117265E	0_2_0117265E
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0106C651	0_2_0106C651
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01066662	0_2_01066662
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_00FC5799	0_2_00FC5799
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_00FC8792	0_2_00FC8792
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0104666B	0_2_0104666B
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010D267F	0_2_010D267F
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01038677	0_2_01038677
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0115F66F	0_2_0115F66F
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_00FBA780	0_2_00FBA780
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01169685	0_2_01169685
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010916A8	0_2_010916A8
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010D36BD	0_2_010D36BD
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0102A6B1	0_2_0102A6B1
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0102E6BB	0_2_0102E6BB
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010866B3	0_2_010866B3
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0101F6BC	0_2_0101F6BC
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0106B6C0	0_2_0106B6C0
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010476CD	0_2_010476CD
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0101D6D1	0_2_0101D6D1
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010AD6D7	0_2_010AD6D7
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_00FEF720	0_2_00FEF720
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010BF6EC	0_2_010BF6EC
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010296E8	0_2_010296E8
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_00FB6710	0_2_00FB6710
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010886E4	0_2_010886E4
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010736F3	0_2_010736F3
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0102B903	0_2_0102B903
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010B290C	0_2_010B290C
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0116291F	0_2_0116291F
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010C4905	0_2_010C4905
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01098918	0_2_01098918
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01017914	0_2_01017914
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0102D917	0_2_0102D917
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01035918	0_2_01035918
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0105692C	0_2_0105692C
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_00FD88CB	0_2_00FD88CB
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01084940	0_2_01084940
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010A095A	0_2_010A095A
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01015952	0_2_01015952
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01099953	0_2_01099953
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_00FD18A0	0_2_00FD18A0
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01022961	0_2_01022961
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01026971	0_2_01026971
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01043970	0_2_01043970
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_00FED880	0_2_00FED880
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010BD98D	0_2_010BD98D
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010A9982	0_2_010A9982
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01066989	0_2_01066989
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010A699C	0_2_010A699C
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_00FD3860	0_2_00FD3860
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0100F9A5	0_2_0100F9A5
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010689A0	0_2_010689A0
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0102F9A8	0_2_0102F9A8
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010189AA	0_2_010189AA
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0127699D	0_2_0127699D
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010B69B1	0_2_010B69B1
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0105E9C4	0_2_0105E9C4
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0107C9C1	0_2_0107C9C1
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_00FC682D	0_2_00FC682D
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_011649CC	0_2_011649CC
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010A79D0	0_2_010A79D0
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010B49D7	0_2_010B49D7
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010CB9E7	0_2_010CB9E7
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0106C9EB	0_2_0106C9EB
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_00FE8810	0_2_00FE8810
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0108D9E6	0_2_0108D9E6
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010419F2	0_2_010419F2
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010B881F	0_2_010B881F
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01048811	0_2_01048811
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0101981A	0_2_0101981A
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0101081E	0_2_0101081E
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0108F82D	0_2_0108F82D
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01053828	0_2_01053828
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010B9826	0_2_010B9826
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0109A838	0_2_0109A838
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01074832	0_2_01074832
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010BE832	0_2_010BE832
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_00FC79C1	0_2_00FC79C1
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010BB84E	0_2_010BB84E
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0105084D	0_2_0105084D
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01091859	0_2_01091859
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0105C856	0_2_0105C856
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0103685A	0_2_0103685A
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01081851	0_2_01081851
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0106D86E	0_2_0106D86E
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_00FB5990	0_2_00FB5990
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010C3877	0_2_010C3877
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_00FED980	0_2_00FED980
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010CE889	0_2_010CE889
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01060880	0_2_01060880
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01023888	0_2_01023888
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_00FB3970	0_2_00FB3970
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010BC897	0_2_010BC897
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0104C8B2	0_2_0104C8B2
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0103F8BB	0_2_0103F8BB
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_00FE0940	0_2_00FE0940
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_00FD0939	0_2_00FD0939
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010A18D5	0_2_010A18D5
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010718EA	0_2_010718EA
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0103D8ED	0_2_0103D8ED
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0105F8F4	0_2_0105F8F4
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0107B8FC	0_2_0107B8FC
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0107AB0E	0_2_0107AB0E
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010D3B04	0_2_010D3B04
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01026B10	0_2_01026B10
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01047B13	0_2_01047B13
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0108BB21	0_2_0108BB21
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_00FDCAD0	0_2_00FDCAD0
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01051B36	0_2_01051B36
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0104DB31	0_2_0104DB31
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01044B33	0_2_01044B33
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01099B33	0_2_01099B33
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010A9B49	0_2_010A9B49
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01073B43	0_2_01073B43
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01167B53	0_2_01167B53
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0108EB4E	0_2_0108EB4E
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010AAB43	0_2_010AAB43
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01090B43	0_2_01090B43
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01074B4C	0_2_01074B4C
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01030B59	0_2_01030B59
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01033B67	0_2_01033B67
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0116BB66	0_2_0116BB66
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01058B7D	0_2_01058B7D
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_00FEDA80	0_2_00FEDA80
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01029B8E	0_2_01029B8E
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0105DB88	0_2_0105DB88
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010B2B9B	0_2_010B2B9B
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01040B95	0_2_01040B95
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0107FB92	0_2_0107FB92
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01045B9C	0_2_01045B9C
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01062BA6	0_2_01062BA6
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01115BB8	0_2_01115BB8
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01011BAA	0_2_01011BAA
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_00FDDA53	0_2_00FDDA53
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01096BA6	0_2_01096BA6
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_00FDCA49	0_2_00FDCA49
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010ABBBD	0_2_010ABBBD
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0103ABBB	0_2_0103ABBB
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010CCBB4	0_2_010CCBB4
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0106FBC4	0_2_0106FBC4
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01010BCD	0_2_01010BCD
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010ADBD3	0_2_010ADBD3
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01054BE0	0_2_01054BE0
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_00FBEA10	0_2_00FBEA10
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01028BE9	0_2_01028BE9
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01089BE3	0_2_01089BE3
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0104BBE8	0_2_0104BBE8
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0105AA0C	0_2_0105AA0C
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01032A08	0_2_01032A08
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01050A09	0_2_01050A09
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01010A14	0_2_01010A14
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_00FBDBD9	0_2_00FBDBD9
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010C0A2E	0_2_010C0A2E
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0105BA21	0_2_0105BA21
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0101AA2F	0_2_0101AA2F
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01085A38	0_2_01085A38
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010A9A37	0_2_010A9A37
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01042A47	0_2_01042A47
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010BFA59	0_2_010BFA59
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010C8A50	0_2_010C8A50
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01080A62	0_2_01080A62
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0106BA77	0_2_0106BA77
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01028A70	0_2_01028A70
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01048A72	0_2_01048A72
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010AFA71	0_2_010AFA71
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01031A82	0_2_01031A82
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01095A8B	0_2_01095A8B
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0101FA85	0_2_0101FA85
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_00FEDB60	0_2_00FEDB60
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01012AA5	0_2_01012AA5
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_00FD6B50	0_2_00FD6B50
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010C9AA2	0_2_010C9AA2
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010AEAB1	0_2_010AEAB1
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_00FCCB40	0_2_00FCCB40
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010B9ACE	0_2_010B9ACE
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01067AC0	0_2_01067AC0
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010C5AC0	0_2_010C5AC0
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0107DAC9	0_2_0107DAC9
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0109EADD	0_2_0109EADD
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010C7AD0	0_2_010C7AD0
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_00FDCB22	0_2_00FDCB22
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_00FDCB11	0_2_00FDCB11
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0101CAEE	0_2_0101CAEE
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01025AF0	0_2_01025AF0
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01046AF6	0_2_01046AF6
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_00FE6B08	0_2_00FE6B08
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01029D0C	0_2_01029D0C
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010A4D04	0_2_010A4D04
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0103ED0C	0_2_0103ED0C
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01035D11	0_2_01035D11
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01081D15	0_2_01081D15
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01095D2C	0_2_01095D2C
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01054D2C	0_2_01054D2C
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01046D3E	0_2_01046D3E
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01068D49	0_2_01068D49
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0102CD50	0_2_0102CD50
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0101DD54	0_2_0101DD54
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01049D53	0_2_01049D53
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01017D59	0_2_01017D59
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0108CD50	0_2_0108CD50
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_00FEECA0	0_2_00FEECA0
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01075D59	0_2_01075D59
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0107CD59	0_2_0107CD59
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010BAD6A	0_2_010BAD6A
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_00FDAC90	0_2_00FDAC90
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010B6D7F	0_2_010B6D7F
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0103FD7F	0_2_0103FD7F
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_00FCFC75	0_2_00FCFC75
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010ACD87	0_2_010ACD87
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01093D86	0_2_01093D86
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0105CD95	0_2_0105CD95
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010A2D9A	0_2_010A2D9A
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01041D9E	0_2_01041D9E
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_00FB4C60	0_2_00FB4C60
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0105FD9E	0_2_0105FD9E
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0102DDA3	0_2_0102DDA3
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01059DB5	0_2_01059DB5
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01037DB0	0_2_01037DB0
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010B5DBD	0_2_010B5DBD
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0109DDBE	0_2_0109DDBE
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01078DC5	0_2_01078DC5
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01015DCC	0_2_01015DCC
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0109FDD9	0_2_0109FDD9
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_00FD9C2B	0_2_00FD9C2B
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0102EDDB	0_2_0102EDDB
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010BCDD0	0_2_010BCDD0
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01077DE9	0_2_01077DE9
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010AFDF8	0_2_010AFDF8
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01095DFE	0_2_01095DFE
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_00FCDC00	0_2_00FCDC00
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01088C01	0_2_01088C01

Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: String function: 00FB8030 appears 44 times
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: String function: 00FC4400 appears 65 times

Source: 2ZsJ2iP8Q2.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 2ZsJ2iP8Q2.exe	Static PE information: Section: ZLIB complexity 0.9973579302226028
Source: 2ZsJ2iP8Q2.exe	Static PE information: Section: ndhyrphp ZLIB complexity 0.9949434358618563

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@10/1

Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe

Code function: 0_2_00FE0C70 CoCreateInstance,

0_2_00FE0C70

Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 2ZsJ2iP8Q2.exe	ReversingLabs: Detection: 57%
Source: 2ZsJ2iP8Q2.exe	Virustotal: Detection: 53%

Source: 2ZsJ2iP8Q2.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe

File read: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe

Jump to behavior

Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Section loaded: dpapi.dll	Jump to behavior

Source: 2ZsJ2iP8Q2.exe

Static file information: File size 1825280 > 1048576

Source: 2ZsJ2iP8Q2.exe

Static PE information: Raw size of ndhyrphp is bigger than: 0x100000 < 0x195600

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe

Unpacked PE file: 0.2.2ZsJ2iP8Q2.exe.fb0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ndhyrphp:EW;ctngovzo:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ndhyrphp:EW;ctngovzo:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: 2ZsJ2iP8Q2.exe

Static PE information: real checksum: 0x1ca1c3 should be: 0x1c54c0

Source: 2ZsJ2iP8Q2.exe	Static PE information: section name:
Source: 2ZsJ2iP8Q2.exe	Static PE information: section name: .idata
Source: 2ZsJ2iP8Q2.exe	Static PE information: section name:
Source: 2ZsJ2iP8Q2.exe	Static PE information: section name: ndhyrphp
Source: 2ZsJ2iP8Q2.exe	Static PE information: section name: ctngovzo
Source: 2ZsJ2iP8Q2.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0120C105 push eax; mov dword ptr [esp], ebx	0_2_0120C14E
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_011EC157 push edx; mov dword ptr [esp], eax	0_2_011EC190
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0123A178 push 55A48349h; mov dword ptr [esp], ecx	0_2_0123A192
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01433127 push 5D3458B9h; mov dword ptr [esp], ebx	0_2_01433144
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01433127 push eax; mov dword ptr [esp], edi	0_2_01433157
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0100A17C push edx; mov dword ptr [esp], 315C4691h	0_2_0100AFFF
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0100A17C push esi; mov dword ptr [esp], eax	0_2_0100BF7C
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0100A17C push eax; mov dword ptr [esp], ebx	0_2_0100E5A5
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0100A17C push eax; mov dword ptr [esp], ebp	0_2_0100E5A9
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0122D1AE push edi; mov dword ptr [esp], edx	0_2_0122D217
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0100A1B4 push 4CC1B440h; mov dword ptr [esp], esi	0_2_0100A1BF
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0100A1B4 push ebp; mov dword ptr [esp], ecx	0_2_0100CA9C
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010B01B5 push ebx; mov dword ptr [esp], esp	0_2_010B0688
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010B01B5 push ebp; mov dword ptr [esp], edx	0_2_010B06A9
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010B01B5 push 2C7B698Fh; mov dword ptr [esp], esi	0_2_010B06C5
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010B01B5 push 0DBAFDC5h; mov dword ptr [esp], ebp	0_2_010B07CA
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010B01B5 push esi; mov dword ptr [esp], 7C7D5B93h	0_2_010B080C
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010B01B5 push ebx; mov dword ptr [esp], edx	0_2_010B0846
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010B01B5 push ecx; mov dword ptr [esp], 00000004h	0_2_010B087B
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010B01B5 push edx; mov dword ptr [esp], 00000000h	0_2_010B08B4
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010B01B5 push edx; mov dword ptr [esp], ebx	0_2_010B08C0
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_010B01B5 push edx; mov dword ptr [esp], ecx	0_2_010B08EF
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0100A1CA push 27BE9148h; mov dword ptr [esp], ebx	0_2_0100C7A8
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01433198 push 074A37B4h; mov dword ptr [esp], esi	0_2_01433208
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_01433198 push eax; mov dword ptr [esp], edi	0_2_014332A1
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0100800D push 5EC72AB9h; mov dword ptr [esp], edx	0_2_010080D6
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0100C010 push edi; mov dword ptr [esp], ebp	0_2_0100C011
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0100B01D push 47E97AD8h; mov dword ptr [esp], ebp	0_2_0100C231
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0100A01E push edx; mov dword ptr [esp], edi	0_2_0100A026
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0100A01E push edx; mov dword ptr [esp], esi	0_2_0100D772
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Code function: 0_2_0100C01E push 2A23A516h; mov dword ptr [esp], ebx	0_2_0100C029

Source: 2ZsJ2iP8Q2.exe	Static PE information: section name: entropy: 7.984547595272886
Source: 2ZsJ2iP8Q2.exe	Static PE information: section name: ndhyrphp entropy: 7.95457315735519

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 1007FEC second address: 1007FF6 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FEEFCF2A116h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 1007FF6 second address: 10078C0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FEEFCBE0AD9h 0x00000008 jmp 00007FEEFCBE0AD8h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 nop 0x00000011 stc 0x00000012 push dword ptr [ebp+122D0ED9h] 0x00000018 jmp 00007FEEFCBE0AD5h 0x0000001d call dword ptr [ebp+122D1F77h] 0x00000023 pushad 0x00000024 sub dword ptr [ebp+122D1A9Dh], eax 0x0000002a pushad 0x0000002b add ax, 06E0h 0x00000030 sub edx, dword ptr [ebp+122D27D6h] 0x00000036 popad 0x00000037 xor eax, eax 0x00000039 add dword ptr [ebp+122D1A9Dh], ecx 0x0000003f mov dword ptr [ebp+122D2FC0h], eax 0x00000045 mov edx, dword ptr [esp+28h] 0x00000049 xor dword ptr [ebp+122D1A9Dh], eax 0x0000004f mov dword ptr [ebp+122D29DAh], eax 0x00000055 cld 0x00000056 mov esi, 0000003Ch 0x0000005b pushad 0x0000005c mov edi, dword ptr [ebp+122D27B6h] 0x00000062 adc di, 4445h 0x00000067 popad 0x00000068 add esi, dword ptr [esp+24h] 0x0000006c jng 00007FEEFCBE0AC7h 0x00000072 cmc 0x00000073 lodsw 0x00000075 mov dword ptr [ebp+122D1BE2h], esi 0x0000007b mov dword ptr [ebp+122D2D54h], esi 0x00000081 add eax, dword ptr [esp+24h] 0x00000085 jnc 00007FEEFCBE0AD7h 0x0000008b mov ebx, dword ptr [esp+24h] 0x0000008f xor dword ptr [ebp+122D1A9Dh], eax 0x00000095 nop 0x00000096 jl 00007FEEFCBE0ACAh 0x0000009c push eax 0x0000009d push eax 0x0000009e push edx 0x0000009f jp 00007FEEFCBE0ADDh 0x000000a5 jmp 00007FEEFCBE0AD7h 0x000000aa rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 117A9DD second address: 117AA05 instructions: 0x00000000 rdtsc 0x00000002 js 00007FEEFCF2A116h 0x00000008 jns 00007FEEFCF2A116h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pop esi 0x00000011 push edx 0x00000012 push esi 0x00000013 jmp 00007FEEFCF2A11Fh 0x00000018 pop esi 0x00000019 push edi 0x0000001a pushad 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 117AC6B second address: 117AC86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007FEEFCBE0AD0h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 117AC86 second address: 117AC9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEEFCF2A124h 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 117B21B second address: 117B238 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FEEFCBE0AD0h 0x0000000c jbe 00007FEEFCBE0AC6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 117E412 second address: 117E417 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 117E417 second address: 117E421 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007FEEFCBE0AC6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 117E421 second address: 117E425 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 117E4B3 second address: 117E532 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007FEEFCBE0AD7h 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jp 00007FEEFCBE0ADEh 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 jmp 00007FEEFCBE0AD9h 0x0000001b mov eax, dword ptr [eax] 0x0000001d jmp 00007FEEFCBE0AD6h 0x00000022 mov dword ptr [esp+04h], eax 0x00000026 push ecx 0x00000027 pushad 0x00000028 jnc 00007FEEFCBE0AC6h 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 117E65C second address: 117E660 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 117E660 second address: 117E708 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007FEEFCBE0ACCh 0x0000000c popad 0x0000000d mov dword ptr [esp], eax 0x00000010 movzx edx, di 0x00000013 push 00000000h 0x00000015 jnp 00007FEEFCBE0ACDh 0x0000001b jc 00007FEEFCBE0AC7h 0x00000021 cld 0x00000022 push 438CC52Bh 0x00000027 jnp 00007FEEFCBE0ADEh 0x0000002d jnc 00007FEEFCBE0AD8h 0x00000033 xor dword ptr [esp], 438CC5ABh 0x0000003a and cl, FFFFFFACh 0x0000003d push 00000003h 0x0000003f xor edi, 6DCEE3F6h 0x00000045 push 00000000h 0x00000047 mov di, A28Ah 0x0000004b push 00000003h 0x0000004d adc edx, 059A9A24h 0x00000053 push 590A76A9h 0x00000058 jmp 00007FEEFCBE0AD8h 0x0000005d add dword ptr [esp], 66F58957h 0x00000064 mov dl, 67h 0x00000066 lea ebx, dword ptr [ebp+1244A30Ch] 0x0000006c or dword ptr [ebp+122D1BCFh], esi 0x00000072 push eax 0x00000073 push eax 0x00000074 push edx 0x00000075 push ebx 0x00000076 jns 00007FEEFCBE0AC6h 0x0000007c pop ebx 0x0000007d rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 117E708 second address: 117E70E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 117E70E second address: 117E712 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 117E7AD second address: 117E7B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 117E7B3 second address: 117E7B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 117E7B7 second address: 117E7C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 117E7C5 second address: 117E7C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 117E7C9 second address: 117E867 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FEEFCF2A116h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FEEFCF2A126h 0x0000000f popad 0x00000010 nop 0x00000011 sub dword ptr [ebp+122D192Ah], esi 0x00000017 movzx ecx, cx 0x0000001a push 00000000h 0x0000001c push 00000000h 0x0000001e push esi 0x0000001f call 00007FEEFCF2A118h 0x00000024 pop esi 0x00000025 mov dword ptr [esp+04h], esi 0x00000029 add dword ptr [esp+04h], 00000015h 0x00000031 inc esi 0x00000032 push esi 0x00000033 ret 0x00000034 pop esi 0x00000035 ret 0x00000036 pushad 0x00000037 and ebx, dword ptr [ebp+122D2A36h] 0x0000003d push edi 0x0000003e sub ch, FFFFFFABh 0x00000041 pop eax 0x00000042 popad 0x00000043 push 6CA3C2AFh 0x00000048 jc 00007FEEFCF2A124h 0x0000004e xor dword ptr [esp], 6CA3C22Fh 0x00000055 xor dword ptr [ebp+122D1AD0h], edx 0x0000005b push 00000003h 0x0000005d sub dword ptr [ebp+122D1E3Ah], ebx 0x00000063 push 00000000h 0x00000065 mov dx, di 0x00000068 push 00000003h 0x0000006a xor dh, FFFFFF96h 0x0000006d call 00007FEEFCF2A119h 0x00000072 push eax 0x00000073 push edx 0x00000074 push eax 0x00000075 push edx 0x00000076 push ecx 0x00000077 pop ecx 0x00000078 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 117E867 second address: 117E883 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEFCBE0AD8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 117E883 second address: 117E88D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007FEEFCF2A116h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 117E88D second address: 117E8B4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEFCBE0AD7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d js 00007FEEFCBE0ACCh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 117E8B4 second address: 117E8E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 mov eax, dword ptr [esp+04h] 0x00000009 js 00007FEEFCF2A122h 0x0000000f jnl 00007FEEFCF2A11Ch 0x00000015 mov eax, dword ptr [eax] 0x00000017 jnp 00007FEEFCF2A11Ah 0x0000001d mov dword ptr [esp+04h], eax 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 push eax 0x00000025 pop eax 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 117E8E6 second address: 117E8EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 117E8EB second address: 117E90E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 stc 0x0000000a lea ebx, dword ptr [ebp+1244A317h] 0x00000010 cld 0x00000011 xchg eax, ebx 0x00000012 pushad 0x00000013 jnl 00007FEEFCF2A11Ch 0x00000019 push eax 0x0000001a push edx 0x0000001b push edx 0x0000001c pop edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 117E90E second address: 117E92E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FEEFCBE0AD6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 119E845 second address: 119E873 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007FEEFCF2A11Eh 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jne 00007FEEFCF2A128h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 119C6BB second address: 119C6C4 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 119C995 second address: 119C999 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 119C999 second address: 119C99F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 119C99F second address: 119C9AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push ebx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 119CAF5 second address: 119CB05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 js 00007FEEFCBE0AC6h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 119CB05 second address: 119CB11 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 119CB11 second address: 119CB17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 119CB17 second address: 119CB1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 119CB1B second address: 119CB3C instructions: 0x00000000 rdtsc 0x00000002 ja 00007FEEFCBE0AC6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FEEFCBE0AD5h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 119CB3C second address: 119CB56 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEEFCF2A124h 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 119CDB5 second address: 119CDBB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 119CDBB second address: 119CDBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 119D263 second address: 119D27E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jnl 00007FEEFCBE0AC6h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ecx 0x0000000d jmp 00007FEEFCBE0ACBh 0x00000012 push esi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 119D27E second address: 119D284 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 119D370 second address: 119D376 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 119D376 second address: 119D398 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FEEFCF2A116h 0x00000008 jmp 00007FEEFCF2A122h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 push edi 0x00000014 pop edi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 119D398 second address: 119D3BA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FEEFCBE0AD8h 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 119D3BA second address: 119D3C9 instructions: 0x00000000 rdtsc 0x00000002 js 00007FEEFCF2A116h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push edi 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 119D667 second address: 119D6A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 jmp 00007FEEFCBE0AD6h 0x0000000c jmp 00007FEEFCBE0AD9h 0x00000011 push eax 0x00000012 push edx 0x00000013 jno 00007FEEFCBE0AC6h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 119D6A7 second address: 119D6AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 119D80D second address: 119D817 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FEEFCBE0AC6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 119D817 second address: 119D81D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 1193BC3 second address: 1193BC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 1193BC9 second address: 1193BE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FEEFCF2A116h 0x0000000a popad 0x0000000b pop esi 0x0000000c jo 00007FEEFCF2A12Ah 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 pop edx 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 1193BE3 second address: 1193BE9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 119D978 second address: 119D97C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 119D97C second address: 119D98E instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FEEFCBE0AC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a js 00007FEEFCBE0ADEh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 119DF6C second address: 119DF8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jo 00007FEEFCF2A12Bh 0x0000000b jnc 00007FEEFCF2A116h 0x00000011 jmp 00007FEEFCF2A11Fh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 119DF8C second address: 119DF98 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jc 00007FEEFCBE0AC6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 119DF98 second address: 119DFBD instructions: 0x00000000 rdtsc 0x00000002 je 00007FEEFCF2A116h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007FEEFCF2A11Fh 0x00000012 push ecx 0x00000013 jc 00007FEEFCF2A116h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11A22BA second address: 11A22C9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jng 00007FEEFCBE0AC6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11A2902 second address: 11A2906 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11A2906 second address: 11A290A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11A290A second address: 11A2917 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11A2917 second address: 11A291B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11A291B second address: 11A2934 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push eax 0x0000000c push edx 0x0000000d js 00007FEEFCF2A11Ch 0x00000013 jng 00007FEEFCF2A116h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11A2934 second address: 11A293A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11A293A second address: 11A293E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11A11F2 second address: 11A11F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11A2A79 second address: 11A2A83 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FEEFCF2A116h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11A2A83 second address: 11A2AB4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FEEFCBE0AD1h 0x00000008 jp 00007FEEFCBE0AC6h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 pushad 0x00000013 jmp 00007FEEFCBE0ACFh 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11A2AB4 second address: 11A2AE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FEEFCF2A116h 0x0000000a popad 0x0000000b popad 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 jno 00007FEEFCF2A122h 0x00000016 mov eax, dword ptr [eax] 0x00000018 pushad 0x00000019 jl 00007FEEFCF2A11Ch 0x0000001f jo 00007FEEFCF2A116h 0x00000025 push eax 0x00000026 push edx 0x00000027 push esi 0x00000028 pop esi 0x00000029 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 1164051 second address: 1164057 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 1164057 second address: 116405D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 116405D second address: 1164069 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 1164069 second address: 116406F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11A9D97 second address: 11A9D9E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11AB6FA second address: 11AB6FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11AB6FE second address: 11AB75D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007FEEFCBE0AD5h 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 jmp 00007FEEFCBE0AD3h 0x00000016 mov eax, dword ptr [eax] 0x00000018 jmp 00007FEEFCBE0AD3h 0x0000001d mov dword ptr [esp+04h], eax 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007FEEFCBE0AD0h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11AB75D second address: 11AB763 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11AB763 second address: 11AB807 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 push 00000000h 0x0000000b push ecx 0x0000000c call 00007FEEFCBE0AC8h 0x00000011 pop ecx 0x00000012 mov dword ptr [esp+04h], ecx 0x00000016 add dword ptr [esp+04h], 00000018h 0x0000001e inc ecx 0x0000001f push ecx 0x00000020 ret 0x00000021 pop ecx 0x00000022 ret 0x00000023 mov edi, 55128CD1h 0x00000028 call 00007FEEFCBE0AC9h 0x0000002d jmp 00007FEEFCBE0AD6h 0x00000032 push eax 0x00000033 jc 00007FEEFCBE0AD3h 0x00000039 jmp 00007FEEFCBE0ACDh 0x0000003e mov eax, dword ptr [esp+04h] 0x00000042 pushad 0x00000043 push eax 0x00000044 jmp 00007FEEFCBE0AD0h 0x00000049 pop eax 0x0000004a jmp 00007FEEFCBE0AD4h 0x0000004f popad 0x00000050 mov eax, dword ptr [eax] 0x00000052 push eax 0x00000053 push edx 0x00000054 pushad 0x00000055 jns 00007FEEFCBE0AC6h 0x0000005b jmp 00007FEEFCBE0ACBh 0x00000060 popad 0x00000061 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11AB807 second address: 11AB811 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FEEFCF2A116h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11AB811 second address: 11AB833 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c pushad 0x0000000d jbe 00007FEEFCBE0AC8h 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FEEFCBE0ACBh 0x0000001c rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11ABF02 second address: 11ABF21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 push eax 0x00000007 pushad 0x00000008 push ecx 0x00000009 jmp 00007FEEFCF2A121h 0x0000000e pop ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11AC38B second address: 11AC40E instructions: 0x00000000 rdtsc 0x00000002 jg 00007FEEFCBE0AC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b mov dword ptr [esp], ebx 0x0000000e push 00000000h 0x00000010 push ebp 0x00000011 call 00007FEEFCBE0AC8h 0x00000016 pop ebp 0x00000017 mov dword ptr [esp+04h], ebp 0x0000001b add dword ptr [esp+04h], 0000001Bh 0x00000023 inc ebp 0x00000024 push ebp 0x00000025 ret 0x00000026 pop ebp 0x00000027 ret 0x00000028 pushad 0x00000029 or edi, dword ptr [ebp+122D27FAh] 0x0000002f call 00007FEEFCBE0AD3h 0x00000034 mov bx, A50Ah 0x00000038 pop eax 0x00000039 popad 0x0000003a push eax 0x0000003b pushad 0x0000003c jns 00007FEEFCBE0AD5h 0x00000042 push eax 0x00000043 push edx 0x00000044 jmp 00007FEEFCBE0AD9h 0x00000049 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11AC91E second address: 11AC924 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11AC924 second address: 11AC92C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11AC92C second address: 11AC937 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11AC937 second address: 11AC940 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11ACE9A second address: 11ACEA0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11AEAB5 second address: 11AEABB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11AE22A second address: 11AE22E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11AEABB second address: 11AEABF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11AE22E second address: 11AE234 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11AEABF second address: 11AEB0E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push edx 0x0000000c jmp 00007FEEFCBE0ACEh 0x00000011 pop edi 0x00000012 and esi, dword ptr [ebp+122D298Eh] 0x00000018 push 00000000h 0x0000001a movsx edi, dx 0x0000001d push 00000000h 0x0000001f push 00000000h 0x00000021 push ebp 0x00000022 call 00007FEEFCBE0AC8h 0x00000027 pop ebp 0x00000028 mov dword ptr [esp+04h], ebp 0x0000002c add dword ptr [esp+04h], 00000019h 0x00000034 inc ebp 0x00000035 push ebp 0x00000036 ret 0x00000037 pop ebp 0x00000038 ret 0x00000039 push eax 0x0000003a push esi 0x0000003b push eax 0x0000003c push edx 0x0000003d pushad 0x0000003e popad 0x0000003f rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11AF506 second address: 11AF50C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11AF242 second address: 11AF25A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEEFCBE0AD4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11AF50C second address: 11AF534 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FEEFCF2A116h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FEEFCF2A129h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11AFF16 second address: 11AFF34 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FEEFCBE0AD3h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11AFC7F second address: 11AFC85 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11AFF34 second address: 11AFFC5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEFCBE0AD0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FEEFCBE0AD4h 0x0000000e popad 0x0000000f nop 0x00000010 push ebx 0x00000011 sub dword ptr [ebp+122D2FCEh], edx 0x00000017 pop edi 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push edx 0x0000001d call 00007FEEFCBE0AC8h 0x00000022 pop edx 0x00000023 mov dword ptr [esp+04h], edx 0x00000027 add dword ptr [esp+04h], 0000001Dh 0x0000002f inc edx 0x00000030 push edx 0x00000031 ret 0x00000032 pop edx 0x00000033 ret 0x00000034 push eax 0x00000035 pop esi 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push esi 0x0000003b call 00007FEEFCBE0AC8h 0x00000040 pop esi 0x00000041 mov dword ptr [esp+04h], esi 0x00000045 add dword ptr [esp+04h], 00000019h 0x0000004d inc esi 0x0000004e push esi 0x0000004f ret 0x00000050 pop esi 0x00000051 ret 0x00000052 mov edi, 7BB73792h 0x00000057 push eax 0x00000058 pushad 0x00000059 push edx 0x0000005a jp 00007FEEFCBE0AC6h 0x00000060 pop edx 0x00000061 push eax 0x00000062 push edx 0x00000063 pushad 0x00000064 popad 0x00000065 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11AFFC5 second address: 11AFFC9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11AFC85 second address: 11AFC8A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11B1597 second address: 11B1620 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEFCF2A11Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c jnp 00007FEEFCF2A116h 0x00000012 pop eax 0x00000013 jnc 00007FEEFCF2A118h 0x00000019 popad 0x0000001a nop 0x0000001b push 00000000h 0x0000001d push ebp 0x0000001e call 00007FEEFCF2A118h 0x00000023 pop ebp 0x00000024 mov dword ptr [esp+04h], ebp 0x00000028 add dword ptr [esp+04h], 00000014h 0x00000030 inc ebp 0x00000031 push ebp 0x00000032 ret 0x00000033 pop ebp 0x00000034 ret 0x00000035 pushad 0x00000036 mov edi, dword ptr [ebp+122D2A6Eh] 0x0000003c mov dword ptr [ebp+122D2104h], edi 0x00000042 popad 0x00000043 mov dword ptr [ebp+122D308Fh], edi 0x00000049 push 00000000h 0x0000004b mov edi, dword ptr [ebp+122D29BEh] 0x00000051 push 00000000h 0x00000053 push 00000000h 0x00000055 push ebx 0x00000056 call 00007FEEFCF2A118h 0x0000005b pop ebx 0x0000005c mov dword ptr [esp+04h], ebx 0x00000060 add dword ptr [esp+04h], 00000016h 0x00000068 inc ebx 0x00000069 push ebx 0x0000006a ret 0x0000006b pop ebx 0x0000006c ret 0x0000006d cmc 0x0000006e push eax 0x0000006f pushad 0x00000070 push eax 0x00000071 push edx 0x00000072 jnl 00007FEEFCF2A116h 0x00000078 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11B21BA second address: 11B21BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11B29B6 second address: 11B29BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11B29BC second address: 11B29C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11B29C0 second address: 11B29E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jmp 00007FEEFCF2A121h 0x00000011 push edi 0x00000012 pop edi 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11B5E02 second address: 11B5E06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11B6316 second address: 11B631A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11B631A second address: 11B631E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11B631E second address: 11B639F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FEEFCF2A126h 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e popad 0x0000000f popad 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push esi 0x00000014 call 00007FEEFCF2A118h 0x00000019 pop esi 0x0000001a mov dword ptr [esp+04h], esi 0x0000001e add dword ptr [esp+04h], 0000001Ch 0x00000026 inc esi 0x00000027 push esi 0x00000028 ret 0x00000029 pop esi 0x0000002a ret 0x0000002b mov dword ptr [ebp+122D1A87h], edx 0x00000031 push 00000000h 0x00000033 mov edi, dword ptr [ebp+122D2748h] 0x00000039 push 00000000h 0x0000003b push 00000000h 0x0000003d push esi 0x0000003e call 00007FEEFCF2A118h 0x00000043 pop esi 0x00000044 mov dword ptr [esp+04h], esi 0x00000048 add dword ptr [esp+04h], 00000018h 0x00000050 inc esi 0x00000051 push esi 0x00000052 ret 0x00000053 pop esi 0x00000054 ret 0x00000055 xchg eax, esi 0x00000056 push eax 0x00000057 push edx 0x00000058 push eax 0x00000059 push edx 0x0000005a jp 00007FEEFCF2A116h 0x00000060 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11B639F second address: 11B63B8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEFCBE0AD5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11B959A second address: 11B9611 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEFCF2A125h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a pushad 0x0000000b popad 0x0000000c pop esi 0x0000000d popad 0x0000000e push eax 0x0000000f pushad 0x00000010 jmp 00007FEEFCF2A11Eh 0x00000015 jns 00007FEEFCF2A12Fh 0x0000001b popad 0x0000001c nop 0x0000001d xor edi, 2D5AA70Ah 0x00000023 push 00000000h 0x00000025 mov dword ptr [ebp+122D1ABAh], edi 0x0000002b push 00000000h 0x0000002d stc 0x0000002e xchg eax, esi 0x0000002f push eax 0x00000030 push edx 0x00000031 jbe 00007FEEFCF2A124h 0x00000037 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11BB450 second address: 11BB456 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11BB456 second address: 11BB45B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11BB45B second address: 11BB4B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push esi 0x0000000f call 00007FEEFCBE0AC8h 0x00000014 pop esi 0x00000015 mov dword ptr [esp+04h], esi 0x00000019 add dword ptr [esp+04h], 00000015h 0x00000021 inc esi 0x00000022 push esi 0x00000023 ret 0x00000024 pop esi 0x00000025 ret 0x00000026 mov edi, dword ptr [ebp+122D28A6h] 0x0000002c push 00000000h 0x0000002e push 00000000h 0x00000030 push edx 0x00000031 call 00007FEEFCBE0AC8h 0x00000036 pop edx 0x00000037 mov dword ptr [esp+04h], edx 0x0000003b add dword ptr [esp+04h], 00000017h 0x00000043 inc edx 0x00000044 push edx 0x00000045 ret 0x00000046 pop edx 0x00000047 ret 0x00000048 push 00000000h 0x0000004a xchg eax, esi 0x0000004b push ecx 0x0000004c pushad 0x0000004d pushad 0x0000004e popad 0x0000004f push eax 0x00000050 push edx 0x00000051 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11B658F second address: 11B6595 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11BE75E second address: 11BE7AB instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007FEEFCBE0ACFh 0x0000000e ja 00007FEEFCBE0ADFh 0x00000014 jmp 00007FEEFCBE0AD9h 0x00000019 popad 0x0000001a nop 0x0000001b mov edi, eax 0x0000001d push 00000000h 0x0000001f mov di, dx 0x00000022 push 00000000h 0x00000024 mov bx, ABBEh 0x00000028 push eax 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11BE7AB second address: 11BE7B5 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FEEFCF2A116h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11BE7B5 second address: 11BE7BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11BE7BB second address: 11BE7BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11BA538 second address: 11BA53C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11BA53C second address: 11BA542 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11BB64A second address: 11BB655 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FEEFCBE0AC6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11BB655 second address: 11BB65B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11BB65B second address: 11BB65F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11BB718 second address: 11BB71C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11C0608 second address: 11C0660 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEFCBE0AD5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jg 00007FEEFCBE0ACCh 0x0000000f popad 0x00000010 nop 0x00000011 or dword ptr [ebp+122D1B08h], edi 0x00000017 xor dword ptr [ebp+122D2D82h], edi 0x0000001d push 00000000h 0x0000001f mov edi, dword ptr [ebp+12471DC6h] 0x00000025 push 00000000h 0x00000027 mov bh, dh 0x00000029 xchg eax, esi 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d jmp 00007FEEFCBE0AD2h 0x00000032 push edx 0x00000033 pop edx 0x00000034 popad 0x00000035 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11C0660 second address: 11C067A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEFCF2A11Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d push edi 0x0000000e pop edi 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11C067A second address: 11C0680 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11C0680 second address: 11C0684 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11C15C7 second address: 11C15CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11C15CB second address: 11C15D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11C15D8 second address: 11C15DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11C15DE second address: 11C15E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11C15E3 second address: 11C15EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11C25EB second address: 11C25F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11C451C second address: 11C452C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a jng 00007FEEFCBE0AC6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11C555B second address: 11C555F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11C07C6 second address: 11C07CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11C1827 second address: 11C1834 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jns 00007FEEFCF2A116h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11C07CA second address: 11C07D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007FEEFCBE0ACCh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11C388A second address: 11C388E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11C5732 second address: 11C57E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 nop 0x00000005 sub edi, 21B6C756h 0x0000000b push dword ptr fs:[00000000h] 0x00000012 jmp 00007FEEFCBE0AD9h 0x00000017 mov dword ptr fs:[00000000h], esp 0x0000001e add edi, dword ptr [ebp+122D2A12h] 0x00000024 movsx ebx, cx 0x00000027 mov eax, dword ptr [ebp+122D0729h] 0x0000002d push 00000000h 0x0000002f push ecx 0x00000030 call 00007FEEFCBE0AC8h 0x00000035 pop ecx 0x00000036 mov dword ptr [esp+04h], ecx 0x0000003a add dword ptr [esp+04h], 00000016h 0x00000042 inc ecx 0x00000043 push ecx 0x00000044 ret 0x00000045 pop ecx 0x00000046 ret 0x00000047 mov ebx, esi 0x00000049 jns 00007FEEFCBE0AD2h 0x0000004f push FFFFFFFFh 0x00000051 push 00000000h 0x00000053 push eax 0x00000054 call 00007FEEFCBE0AC8h 0x00000059 pop eax 0x0000005a mov dword ptr [esp+04h], eax 0x0000005e add dword ptr [esp+04h], 0000001Dh 0x00000066 inc eax 0x00000067 push eax 0x00000068 ret 0x00000069 pop eax 0x0000006a ret 0x0000006b movsx ebx, dx 0x0000006e nop 0x0000006f jmp 00007FEEFCBE0AD0h 0x00000074 push eax 0x00000075 push eax 0x00000076 push edx 0x00000077 push eax 0x00000078 push edx 0x00000079 pushad 0x0000007a popad 0x0000007b rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11C57E7 second address: 11C57ED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11CDA8C second address: 11CDA98 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FEEFCBE0ACEh 0x00000008 push esi 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11CD1DF second address: 11CD1E9 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FEEFCF2A116h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11CD336 second address: 11CD33A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11CD33A second address: 11CD358 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FEEFCF2A116h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007FEEFCF2A11Fh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11D4D0D second address: 11D4D11 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11D4D11 second address: 11D4D45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jnc 00007FEEFCF2A116h 0x0000000d pop ebx 0x0000000e popad 0x0000000f push eax 0x00000010 pushad 0x00000011 jmp 00007FEEFCF2A122h 0x00000016 jnp 00007FEEFCF2A118h 0x0000001c popad 0x0000001d mov eax, dword ptr [esp+04h] 0x00000021 pushad 0x00000022 push eax 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11D4D45 second address: 11D4D5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007FEEFCBE0ACBh 0x0000000a popad 0x0000000b mov eax, dword ptr [eax] 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11D4D5D second address: 11D4D68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FEEFCF2A116h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11D4D68 second address: 11D4D7D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FEEFCBE0AD0h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11D4E91 second address: 11D4E9B instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FEEFCF2A116h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11D4F85 second address: 11D4FA0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEFCBE0ACCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11D4FA0 second address: 11D4FA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11D4FA5 second address: 11D4FAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11D4FAB second address: 11D4FAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11D4FAF second address: 11D4FB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11D50AA second address: 11D50B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 1172FDB second address: 1172FE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 1172FE1 second address: 117300D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007FEEFCF2A121h 0x0000000a popad 0x0000000b pushad 0x0000000c jmp 00007FEEFCF2A120h 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11D974F second address: 11D9766 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnl 00007FEEFCBE0AC6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jo 00007FEEFCBE0AC6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11D9766 second address: 11D977A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007FEEFCF2A11Ch 0x0000000e jl 00007FEEFCF2A116h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11D977A second address: 11D9782 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11D9F24 second address: 11D9F28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11DA09C second address: 11DA0A6 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FEEFCBE0AC6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11DA3AA second address: 11DA3B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11DA4F7 second address: 11DA506 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11DA506 second address: 11DA52B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FEEFCF2A128h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11DED9F second address: 11DEDA4 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11B3381 second address: 1193BC3 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b jmp 00007FEEFCF2A11Bh 0x00000010 call dword ptr [ebp+122D24CCh] 0x00000016 push esi 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11B3553 second address: 11B357B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jg 00007FEEFCBE0AC6h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e jl 00007FEEFCBE0AD7h 0x00000014 jmp 00007FEEFCBE0AD1h 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11B413A second address: 11B416D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b cld 0x0000000c push 0000001Eh 0x0000000e push 00000000h 0x00000010 push edi 0x00000011 call 00007FEEFCF2A118h 0x00000016 pop edi 0x00000017 mov dword ptr [esp+04h], edi 0x0000001b add dword ptr [esp+04h], 00000018h 0x00000023 inc edi 0x00000024 push edi 0x00000025 ret 0x00000026 pop edi 0x00000027 ret 0x00000028 nop 0x00000029 push edx 0x0000002a pushad 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11B42B8 second address: 11B42BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11B42BC second address: 11B42C2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11B44FA second address: 11B44FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11B44FE second address: 11B4530 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jg 00007FEEFCF2A116h 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 popad 0x00000011 mov dword ptr [esp], eax 0x00000014 mov dx, ax 0x00000017 mov edi, dword ptr [ebp+124729E1h] 0x0000001d lea eax, dword ptr [ebp+1247F0E7h] 0x00000023 mov cx, A15Fh 0x00000027 nop 0x00000028 push eax 0x00000029 push edx 0x0000002a jno 00007FEEFCF2A118h 0x00000030 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11B4530 second address: 11B4535 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11B4535 second address: 11B4547 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b jng 00007FEEFCF2A116h 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11B4547 second address: 11B4585 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEFCBE0AD4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov dh, 95h 0x0000000c lea eax, dword ptr [ebp+1247F0A3h] 0x00000012 jg 00007FEEFCBE0AD2h 0x00000018 nop 0x00000019 jc 00007FEEFCBE0AD4h 0x0000001f push eax 0x00000020 push edx 0x00000021 push ecx 0x00000022 pop ecx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11B4585 second address: 11B45AD instructions: 0x00000000 rdtsc 0x00000002 js 00007FEEFCF2A116h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FEEFCF2A129h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11B45AD second address: 11B45B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11B45B1 second address: 11B45B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11B45B7 second address: 11946C9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEFCBE0AD3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a jmp 00007FEEFCBE0AD1h 0x0000000f call dword ptr [ebp+122D2D6Eh] 0x00000015 pushad 0x00000016 jmp 00007FEEFCBE0AD8h 0x0000001b pushad 0x0000001c push ebx 0x0000001d pop ebx 0x0000001e pushad 0x0000001f popad 0x00000020 popad 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007FEEFCBE0AD1h 0x00000028 push esi 0x00000029 pop esi 0x0000002a rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11DDFE0 second address: 11DE000 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 jmp 00007FEEFCF2A11Fh 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e pop eax 0x0000000f popad 0x00000010 pushad 0x00000011 pushad 0x00000012 push edx 0x00000013 pop edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11DE000 second address: 11DE020 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEEFCBE0AD7h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11B331C second address: 11B3320 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11B3320 second address: 11B3381 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEFCBE0ACEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushad 0x0000000c jmp 00007FEEFCBE0ACDh 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 jmp 00007FEEFCBE0ACEh 0x00000019 popad 0x0000001a nop 0x0000001b jne 00007FEEFCBE0ADAh 0x00000021 lea eax, dword ptr [ebp+1247F0A3h] 0x00000027 stc 0x00000028 push eax 0x00000029 push eax 0x0000002a push edx 0x0000002b push ebx 0x0000002c jbe 00007FEEFCBE0AC6h 0x00000032 pop ebx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11DE6E4 second address: 11DE702 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FEEFCF2A11Fh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e pop edi 0x0000000f push edx 0x00000010 push edx 0x00000011 pop edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11DE832 second address: 11DE836 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11DE836 second address: 11DE83C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11DE83C second address: 11DE841 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11E4D9A second address: 11E4DB9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEFCF2A121h 0x00000007 jnl 00007FEEFCF2A116h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11E4DB9 second address: 11E4DC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FEEFCBE0AC6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11E4DC3 second address: 11E4DDC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEFCF2A125h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11E4DDC second address: 11E4DFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 jno 00007FEEFCBE0ACCh 0x0000000e jmp 00007FEEFCBE0ACBh 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11E4DFE second address: 11E4E04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11E50BF second address: 11E50D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 js 00007FEEFCBE0AD2h 0x0000000b js 00007FEEFCBE0AC6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11E50D2 second address: 11E50F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007FEEFCF2A128h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11E50F3 second address: 11E50F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11E54B7 second address: 11E54BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11E54BD second address: 11E54C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11E561A second address: 11E5624 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11E5923 second address: 11E5927 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11E5927 second address: 11E594B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pushad 0x00000008 push ebx 0x00000009 jmp 00007FEEFCF2A129h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11E594B second address: 11E5965 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 jmp 00007FEEFCBE0AD0h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11E48D5 second address: 11E48E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jl 00007FEEFCF2A122h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11E48E3 second address: 11E48E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11E48E9 second address: 11E4909 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 pushad 0x00000008 popad 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d jmp 00007FEEFCF2A121h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11E4909 second address: 11E4915 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FEEFCBE0AC6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11E7B90 second address: 11E7BC7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEFCF2A11Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a pushad 0x0000000b jmp 00007FEEFCF2A129h 0x00000010 push eax 0x00000011 push edx 0x00000012 jc 00007FEEFCF2A116h 0x00000018 push esi 0x00000019 pop esi 0x0000001a rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 116C678 second address: 116C684 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FEEFCBE0AC6h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11EBD55 second address: 11EBD5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FEEFCF2A116h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11EBF08 second address: 11EBF0D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11EC02E second address: 11EC03F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 js 00007FEEFCF2A116h 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f pop eax 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11EC03F second address: 11EC049 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007FEEFCBE0AC6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11EC049 second address: 11EC053 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FEEFCF2A116h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11EC053 second address: 11EC073 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FEEFCBE0AD6h 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11EC32E second address: 11EC35E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEEFCF2A11Fh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e jmp 00007FEEFCF2A128h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11EC35E second address: 11EC377 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEFCBE0AD3h 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11EC377 second address: 11EC389 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jg 00007FEEFCF2A116h 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11EC8BB second address: 11EC8C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11EC8C1 second address: 11EC917 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a jmp 00007FEEFCF2A11Ah 0x0000000f jmp 00007FEEFCF2A122h 0x00000014 pushad 0x00000015 popad 0x00000016 jne 00007FEEFCF2A116h 0x0000001c popad 0x0000001d jno 00007FEEFCF2A132h 0x00000023 pushad 0x00000024 pushad 0x00000025 popad 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11ECD25 second address: 11ECD2B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11F0275 second address: 11F0290 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEEFCF2A125h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11F0290 second address: 11F0294 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11F0294 second address: 11F029A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 116E12C second address: 116E144 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FEEFCBE0AC8h 0x00000008 jng 00007FEEFCBE0AD2h 0x0000000e jp 00007FEEFCBE0AC6h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11F2DB2 second address: 11F2DB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11F2DB6 second address: 11F2DC7 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 js 00007FEEFCBE0AC6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11F2DC7 second address: 11F2DD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 jne 00007FEEFCF2A116h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11F2DD6 second address: 11F2E0C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEFCBE0AD3h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b ja 00007FEEFCBE0ADDh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11F2E0C second address: 11F2E11 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11F2E11 second address: 11F2E1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FEEFCBE0AC6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11F5EB2 second address: 11F5EB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11F57DE second address: 11F57E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11F5AA7 second address: 11F5ABD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEEFCF2A120h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11F823E second address: 11F8261 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007FEEFCBE0AD3h 0x00000008 jp 00007FEEFCBE0AC6h 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11F8261 second address: 11F8265 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11F8265 second address: 11F8279 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e jg 00007FEEFCBE0AC6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11F8279 second address: 11F828C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEFCF2A11Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11F828C second address: 11F8292 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11F8292 second address: 11F8297 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11F8297 second address: 11F82A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jp 00007FEEFCBE0AC6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11F7D86 second address: 11F7D9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEEFCF2A124h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11F7D9E second address: 11F7DA2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11F7DA2 second address: 11F7DC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 je 00007FEEFCF2A116h 0x0000000d jo 00007FEEFCF2A116h 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 pop eax 0x00000017 pushad 0x00000018 ja 00007FEEFCF2A11Eh 0x0000001e pushad 0x0000001f popad 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11F7DC4 second address: 11F7E07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jmp 00007FEEFCBE0ACFh 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007FEEFCBE0AD8h 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FEEFCBE0AD2h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11FCB39 second address: 11FCB45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 jnl 00007FEEFCF2A116h 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11FC1A4 second address: 11FC1D2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FEEFCBE0AD1h 0x00000010 jmp 00007FEEFCBE0AD2h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11FC45C second address: 11FC49C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jng 00007FEEFCF2A116h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007FEEFCF2A122h 0x00000012 jng 00007FEEFCF2A135h 0x00000018 jmp 00007FEEFCF2A129h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11FF7F5 second address: 11FF800 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11FF800 second address: 11FF804 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11FF804 second address: 11FF808 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 1203F26 second address: 1203F2A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 1203F2A second address: 1203F6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEEFCBE0ACBh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jmp 00007FEEFCBE0AD8h 0x00000013 jmp 00007FEEFCBE0AD0h 0x00000018 jl 00007FEEFCBE0AC6h 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 12041F2 second address: 120420E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEEFCF2A126h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 120420E second address: 1204212 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 1204212 second address: 120424C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEEFCF2A11Ah 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e jmp 00007FEEFCF2A11Ah 0x00000013 jnc 00007FEEFCF2A116h 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c push eax 0x0000001d push edx 0x0000001e je 00007FEEFCF2A118h 0x00000024 jmp 00007FEEFCF2A11Ah 0x00000029 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 12043D9 second address: 12043EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FEEFCBE0AC6h 0x0000000a jc 00007FEEFCBE0AC6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 120454B second address: 1204561 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEFCF2A11Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 1204561 second address: 120457D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEEFCBE0AD8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 120457D second address: 12045A6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEFCF2A11Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FEEFCF2A126h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 12045A6 second address: 12045AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 12045AC second address: 12045B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11B3FAA second address: 11B3FB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 11B3FB2 second address: 11B3FE3 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FEEFCF2A116h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b nop 0x0000000c mov dword ptr [ebp+122D543Ah], eax 0x00000012 mov ebx, dword ptr [ebp+1247F0E2h] 0x00000018 sub dword ptr [ebp+122D307Ch], eax 0x0000001e add eax, ebx 0x00000020 or di, 3D3Ah 0x00000025 stc 0x00000026 push eax 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a jnc 00007FEEFCF2A116h 0x00000030 pop eax 0x00000031 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 120B83B second address: 120B83F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 120B83F second address: 120B843 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 120B843 second address: 120B849 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 120C372 second address: 120C378 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 120C9A1 second address: 120C9A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 120CC4D second address: 120CC7E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEFCF2A124h 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d jmp 00007FEEFCF2A123h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 120CF81 second address: 120CF87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 120D23A second address: 120D242 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 121290C second address: 1212912 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 1212912 second address: 121291C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 121291C second address: 1212920 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 1212B7F second address: 1212B99 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FEEFCF2A116h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FEEFCF2A11Eh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 1212E38 second address: 1212E5D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jp 00007FEEFCBE0AC6h 0x0000000e jmp 00007FEEFCBE0AD7h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 121327A second address: 1213280 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 1213280 second address: 121328D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jp 00007FEEFCBE0ACCh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 1165B35 second address: 1165B3D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push edx 0x00000007 pop edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 121DB5E second address: 121DB62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 121DB62 second address: 121DB7E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEFCF2A11Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a js 00007FEEFCF2A116h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 121DB7E second address: 121DB9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEEFCBE0AD8h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 121DB9C second address: 121DBA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 121DBA7 second address: 121DBAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 121DEBB second address: 121DEBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 121E28E second address: 121E2B5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEFCBE0AD8h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FEEFCBE0ACBh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 121E2B5 second address: 121E2BF instructions: 0x00000000 rdtsc 0x00000002 jns 00007FEEFCF2A116h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 121E588 second address: 121E592 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007FEEFCBE0AC6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 121E809 second address: 121E834 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jo 00007FEEFCF2A12Ch 0x0000000b push eax 0x0000000c pop eax 0x0000000d jmp 00007FEEFCF2A124h 0x00000012 push eax 0x00000013 push edx 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 jns 00007FEEFCF2A116h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 121F6E2 second address: 121F6EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jnl 00007FEEFCBE0AC6h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 121F6EF second address: 121F726 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FEEFCF2A11Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c jmp 00007FEEFCF2A124h 0x00000011 jns 00007FEEFCF2A116h 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a jno 00007FEEFCF2A116h 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 121F726 second address: 121F72A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 121F72A second address: 121F73F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEFCF2A121h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 121D59C second address: 121D5A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FEEFCBE0AC6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 121D5A6 second address: 121D5AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 121D5AA second address: 121D5B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 121D5B0 second address: 121D5BA instructions: 0x00000000 rdtsc 0x00000002 jc 00007FEEFCF2A11Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 121D5BA second address: 121D5C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 121D5C3 second address: 121D5E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FEEFCF2A116h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FEEFCF2A121h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 121D5E3 second address: 121D60D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FEEFCBE0AD9h 0x00000008 ja 00007FEEFCBE0AC6h 0x0000000e jbe 00007FEEFCBE0AC6h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 121D60D second address: 121D615 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 1225D59 second address: 1225D7D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007FEEFCBE0AD8h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e pop edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 1225D7D second address: 1225D81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 122982E second address: 1229833 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 1229981 second address: 12299AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEEFCF2A122h 0x00000009 jmp 00007FEEFCF2A126h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 12299AD second address: 12299BE instructions: 0x00000000 rdtsc 0x00000002 jne 00007FEEFCBE0AC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 12299BE second address: 12299D8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEFCF2A126h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 12299D8 second address: 1229A14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FEEFCBE0AD8h 0x0000000c jmp 00007FEEFCBE0ACCh 0x00000011 jmp 00007FEEFCBE0ACCh 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 1229A14 second address: 1229A18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 122D0F0 second address: 122D113 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEFCBE0AD9h 0x00000007 jnc 00007FEEFCBE0AC6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 122D113 second address: 122D11E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jns 00007FEEFCF2A116h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 122E80E second address: 122E81D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEFCBE0ACBh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 122E81D second address: 122E840 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007FEEFCF2A12Dh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 122E840 second address: 122E852 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEEFCBE0ACCh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 122E852 second address: 122E856 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 1239DA7 second address: 1239DAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 123D6E5 second address: 123D6FD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FEEFCF2A120h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 1242B50 second address: 1242B65 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FEEFCBE0ACEh 0x00000008 push edi 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 124A0C6 second address: 124A0D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FEEFCF2A116h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 124A0D2 second address: 124A11B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FEEFCBE0ACAh 0x0000000a popad 0x0000000b pushad 0x0000000c je 00007FEEFCBE0ACEh 0x00000012 jl 00007FEEFCBE0AC6h 0x00000018 pushad 0x00000019 popad 0x0000001a jmp 00007FEEFCBE0ACFh 0x0000001f pushad 0x00000020 jmp 00007FEEFCBE0AD8h 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 124A11B second address: 124A121 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 1256247 second address: 1256265 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007FEEFCBE0AD7h 0x00000008 pop ecx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 1254C10 second address: 1254C3A instructions: 0x00000000 rdtsc 0x00000002 je 00007FEEFCF2A12Dh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jns 00007FEEFCF2A116h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 1254C3A second address: 1254C3E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 1254C3E second address: 1254C5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FEEFCF2A127h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 1254C5F second address: 1254C63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 1254D97 second address: 1254DA5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007FEEFCF2A118h 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 1254DA5 second address: 1254DBB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEFCBE0ACEh 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 1254DBB second address: 1254DBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 1254DBF second address: 1254DE5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEFCBE0AD5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jne 00007FEEFCBE0AE6h 0x00000011 pushad 0x00000012 push edx 0x00000013 pop edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 1254DE5 second address: 1254DFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEEFCF2A11Ah 0x00000009 popad 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push esi 0x0000000e pop esi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 1254F74 second address: 1254F78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 1254F78 second address: 1254F86 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FEEFCF2A116h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 1254F86 second address: 1254F8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 1254F8A second address: 1254FA3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEFCF2A123h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 12550E4 second address: 12550EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 12550EA second address: 12550F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 12550F0 second address: 12550F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 12550F6 second address: 1255104 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jng 00007FEEFCF2A116h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 125525B second address: 1255266 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 1255266 second address: 125526B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 125526B second address: 1255275 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FEEFCBE0ACEh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 1258AAA second address: 1258AAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 1267407 second address: 1267433 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEFCBE0ACEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FEEFCBE0AD8h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 116095E second address: 1160966 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 1160966 second address: 11609B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEEFCBE0AD8h 0x00000009 js 00007FEEFCBE0AC6h 0x0000000f popad 0x00000010 popad 0x00000011 jng 00007FEEFCBE0AF3h 0x00000017 jns 00007FEEFCBE0ADFh 0x0000001d push esi 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 126215D second address: 1262166 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 1262166 second address: 126216C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 127664F second address: 1276653 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 1276354 second address: 127639E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEFCBE0AD6h 0x00000007 jmp 00007FEEFCBE0AD8h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jmp 00007FEEFCBE0AD8h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 128BC15 second address: 128BC1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 128B010 second address: 128B016 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 128B8D3 second address: 128B8D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 128B8D7 second address: 128B908 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEFCBE0AD2h 0x00000007 jmp 00007FEEFCBE0AD8h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 128B908 second address: 128B918 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEEFCF2A11Bh 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 128B918 second address: 128B93C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FEEFCBE0AD9h 0x00000008 jbe 00007FEEFCBE0AC6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 128E541 second address: 128E545 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 128E610 second address: 128E614 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 128E614 second address: 128E61E instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FEEFCF2A116h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 128E61E second address: 128E624 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 128E7DD second address: 128E801 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEFCF2A122h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FEEFCF2A11Bh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 128EB02 second address: 128EB0F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 128EB0F second address: 128EB19 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 128EB19 second address: 128EB1D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 128EB1D second address: 128EBA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 push edx 0x00000009 and dx, ABB2h 0x0000000e pop edx 0x0000000f push dword ptr [ebp+122D5469h] 0x00000015 xor dword ptr [ebp+1244D3A6h], edx 0x0000001b call 00007FEEFCF2A119h 0x00000020 jbe 00007FEEFCF2A12Eh 0x00000026 jmp 00007FEEFCF2A128h 0x0000002b push eax 0x0000002c jmp 00007FEEFCF2A11Bh 0x00000031 mov eax, dword ptr [esp+04h] 0x00000035 jmp 00007FEEFCF2A125h 0x0000003a mov eax, dword ptr [eax] 0x0000003c jmp 00007FEEFCF2A127h 0x00000041 mov dword ptr [esp+04h], eax 0x00000045 push eax 0x00000046 push edx 0x00000047 push eax 0x00000048 push edx 0x00000049 push edi 0x0000004a pop edi 0x0000004b rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 128EBA7 second address: 128EBAD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 12918C2 second address: 12918D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop ecx 0x00000006 push ecx 0x00000007 pushad 0x00000008 jnp 00007FEEFCF2A116h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 1293552 second address: 1293558 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	RDTSC instruction interceptor: First address: 1293558 second address: 129355C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe

Special instruction interceptor: First address: 1007922 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe

Code function: 0_2_0100A00D rdtsc

0_2_0100A00D

Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe TID: 6684

Thread sleep time: -60000s >= -30000s

Jump to behavior

Source: 2ZsJ2iP8Q2.exe, 2ZsJ2iP8Q2.exe, 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: 2ZsJ2iP8Q2.exe, 00000000.00000003.1456091842.0000000000B37000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000002.1490892168.0000000000AE7000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000002.1490977315.0000000000B37000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 2ZsJ2iP8Q2.exe, 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	File opened: NTICE
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	File opened: SICE
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe

Code function: 0_2_0100A00D rdtsc

0_2_0100A00D

Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe

Code function: 0_2_00FEC1F0 LdrInitializeThunk,

0_2_00FEC1F0

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: 2ZsJ2iP8Q2.exe	String found in binary or memory: rapeflowwj.lat
Source: 2ZsJ2iP8Q2.exe	String found in binary or memory: sustainskelet.lat
Source: 2ZsJ2iP8Q2.exe	String found in binary or memory: crosshuaht.lat
Source: 2ZsJ2iP8Q2.exe	String found in binary or memory: energyaffai.lat
Source: 2ZsJ2iP8Q2.exe	String found in binary or memory: aspecteirs.lat
Source: 2ZsJ2iP8Q2.exe	String found in binary or memory: discokeyus.lat
Source: 2ZsJ2iP8Q2.exe	String found in binary or memory: necklacebudi.lat
Source: 2ZsJ2iP8Q2.exe	String found in binary or memory: sweepyribs.lat
Source: 2ZsJ2iP8Q2.exe	String found in binary or memory: grannyejh.lat

Source: 2ZsJ2iP8Q2.exe, 2ZsJ2iP8Q2.exe, 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\2ZsJ2iP8Q2.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Process Injection	24 Virtualization/Sandbox Evasion	OS Credential Dumping	641 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	LSASS Memory	24 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	4 Obfuscated Files or Information	NTDS	23 System Information Discovery	Distributed Component Object Model	Input Capture	113 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
2ZsJ2iP8Q2.exe	58%	ReversingLabs	Win32.Trojan.Generic
2ZsJ2iP8Q2.exe	54%	Virustotal		Browse
2ZsJ2iP8Q2.exe	100%	Avira	TR/Crypt.XPACK.Gen
2ZsJ2iP8Q2.exe	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Reputation
steamcommunity.com	104.102.49.254	true	false	high
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	high
sustainskelet.lat	unknown	unknown	false	high
crosshuaht.lat	unknown	unknown	false	high
rapeflowwj.lat	unknown	unknown	false	high
grannyejh.lat	unknown	unknown	false	high
aspecteirs.lat	unknown	unknown	false	high
sweepyribs.lat	unknown	unknown	false	high
discokeyus.lat	unknown	unknown	false	high
energyaffai.lat	unknown	unknown	false	high
necklacebudi.lat	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
necklacebudi.lat	false	high
aspecteirs.lat	false	high
sweepyribs.lat	false	high
sustainskelet.lat	false	high
crosshuaht.lat	false	high
rapeflowwj.lat	false	high
https://steamcommunity.com/profiles/76561199724331900	false	high
energyaffai.lat	false	high
grannyejh.lat	false	high
discokeyus.lat	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://steamcommunity.com/my/wishlist/	2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B84000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp	false	high
https://player.vimeo.com	2ZsJ2iP8Q2.exe, 00000000.00000002.1490977315.0000000000B37000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000002.1491103778.0000000000B75000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&	2ZsJ2iP8Q2.exe, 00000000.00000003.1456329603.0000000000B75000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000002.1491103778.0000000000B75000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steamcommunity.com/?subsection=broadcasts	2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp	false	high
https://help.steampowered.com/en/	2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steamcommunity.com/market/	2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/news/	2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/subscriber_agreement/	2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.gstatic.cn/recaptcha/	2ZsJ2iP8Q2.exe, 00000000.00000002.1490977315.0000000000B37000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000002.1491103778.0000000000B75000.00000004.00000020.00020000.00000000.sdmp	false	high
http://store.steampowered.com/subscriber_agreement/	2ZsJ2iP8Q2.exe, 00000000.00000003.1456091842.0000000000AFB000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B84000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	2ZsJ2iP8Q2.exe, 00000000.00000003.1456091842.0000000000AFB000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B84000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=hyEE	2ZsJ2iP8Q2.exe, 00000000.00000003.1456091842.0000000000AFB000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B84000.00000004.00000020.00020000.00000000.sdmp	false	high
https://recaptcha.net/recaptcha/;	2ZsJ2iP8Q2.exe, 00000000.00000002.1490977315.0000000000B37000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000002.1491103778.0000000000B75000.00000004.00000020.00020000.00000000.sdmp	false	high
http://www.valvesoftware.com/legal.htm	2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=wuA4X_n5-mo0&l=en	2ZsJ2iP8Q2.exe, 00000000.00000003.1456329603.0000000000B75000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000002.1491103778.0000000000B75000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steamcommunity.com/discussions/	2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.youtube.com	2ZsJ2iP8Q2.exe, 00000000.00000002.1490977315.0000000000B37000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000002.1491103778.0000000000B75000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.google.com	2ZsJ2iP8Q2.exe, 00000000.00000002.1490977315.0000000000B37000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000002.1491103778.0000000000B75000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/stats/	2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am	2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B84000.00000004.00000020.00020000.00000000.sdmp	false	high
https://medal.tv	2ZsJ2iP8Q2.exe, 00000000.00000002.1490977315.0000000000B37000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000002.1491103778.0000000000B75000.00000004.00000020.00020000.00000000.sdmp	false	high
https://broadcast.st.dl.eccdnx.com	2ZsJ2iP8Q2.exe, 00000000.00000002.1490977315.0000000000B37000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000002.1491103778.0000000000B75000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a	2ZsJ2iP8Q2.exe, 00000000.00000003.1456329603.0000000000B75000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000002.1491103778.0000000000B75000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/steam_refunds/	2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/points/shopU	2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B84000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	2ZsJ2iP8Q2.exe, 00000000.00000003.1456091842.0000000000AFB000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B84000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=Lj6X7NKUMfzk&a	2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B84000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000002.1490892168.0000000000AF9000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900	2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B84000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	2ZsJ2iP8Q2.exe, 00000000.00000003.1456091842.0000000000AFB000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B84000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp	false	high
https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/	2ZsJ2iP8Q2.exe, 00000000.00000002.1490977315.0000000000B37000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000002.1491103778.0000000000B75000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl	2ZsJ2iP8Q2.exe, 00000000.00000003.1456329603.0000000000B75000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000002.1491103778.0000000000B75000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC	2ZsJ2iP8Q2.exe, 00000000.00000003.1456329603.0000000000B75000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000002.1491103778.0000000000B75000.00000004.00000020.00020000.00000000.sdmp	false	high
https://s.ytimg.com;	2ZsJ2iP8Q2.exe, 00000000.00000002.1490977315.0000000000B37000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000002.1491103778.0000000000B75000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steamcommunity.com/workshop/	2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp	false	high
https://login.steampowered.com/	2ZsJ2iP8Q2.exe, 00000000.00000002.1491103778.0000000000B75000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C185ce35c568ebbb	2ZsJ2iP8Q2.exe, 00000000.00000003.1456091842.0000000000B37000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000002.1490977315.0000000000B37000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_c	2ZsJ2iP8Q2.exe, 00000000.00000003.1456329603.0000000000B75000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000002.1491103778.0000000000B75000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	2ZsJ2iP8Q2.exe, 00000000.00000003.1456091842.0000000000AFB000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B84000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&	2ZsJ2iP8Q2.exe, 00000000.00000003.1456329603.0000000000B75000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000002.1491103778.0000000000B75000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/legal/	2ZsJ2iP8Q2.exe, 00000000.00000003.1456091842.0000000000AFB000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B84000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/	2ZsJ2iP8Q2.exe, 00000000.00000002.1491103778.0000000000B75000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/css/skin_1/fatalerror.css?v=OFUqlcDNiD6y&l=engli	2ZsJ2iP8Q2.exe, 00000000.00000003.1456329603.0000000000B75000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000002.1491103778.0000000000B75000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steam.tv/	2ZsJ2iP8Q2.exe, 00000000.00000002.1490977315.0000000000B37000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000002.1491103778.0000000000B75000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steamcommunity.com/0E1	2ZsJ2iP8Q2.exe, 00000000.00000003.1456329603.0000000000B75000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000002.1491103778.0000000000B75000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en	2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B84000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng	2ZsJ2iP8Q2.exe, 00000000.00000003.1456329603.0000000000B75000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000002.1491103778.0000000000B75000.00000004.00000020.00020000.00000000.sdmp	false	high
http://store.steampowered.com/privacy_agreement/	2ZsJ2iP8Q2.exe, 00000000.00000003.1456091842.0000000000AFB000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B84000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/points/shop/	2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp	false	high
https://recaptcha.net	2ZsJ2iP8Q2.exe, 00000000.00000002.1490977315.0000000000B37000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000002.1491103778.0000000000B75000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/	2ZsJ2iP8Q2.exe, 00000000.00000002.1491103778.0000000000B75000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steamcommunity.com	2ZsJ2iP8Q2.exe, 00000000.00000003.1456091842.0000000000AFB000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B84000.00000004.00000020.00020000.00000000.sdmp	false	high
https://sketchfab.com	2ZsJ2iP8Q2.exe, 00000000.00000002.1490977315.0000000000B37000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000002.1491103778.0000000000B75000.00000004.00000020.00020000.00000000.sdmp	false	high
https://lv.queniujq.cn	2ZsJ2iP8Q2.exe, 00000000.00000002.1490977315.0000000000B37000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000002.1491103778.0000000000B75000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.png	2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.youtube.com/	2ZsJ2iP8Q2.exe, 00000000.00000002.1490977315.0000000000B37000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000002.1491103778.0000000000B75000.00000004.00000020.00020000.00000000.sdmp	false	high
http://127.0.0.1:27060	2ZsJ2iP8Q2.exe, 00000000.00000002.1490977315.0000000000B37000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000002.1491103778.0000000000B75000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/privacy_agreement/	2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steamcommunity.com/com1	2ZsJ2iP8Q2.exe, 00000000.00000003.1456329603.0000000000B75000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000002.1491103778.0000000000B75000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=tvQ	2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B84000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am	2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B84000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.google.com/recaptcha/	2ZsJ2iP8Q2.exe, 00000000.00000002.1491103778.0000000000B75000.00000004.00000020.00020000.00000000.sdmp	false	high
https://checkout.steampowered.com/	2ZsJ2iP8Q2.exe, 00000000.00000002.1491103778.0000000000B75000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6QbwI-5-j2S&amp	2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B84000.00000004.00000020.00020000.00000000.sdmp	false	high
https://help.steampowered.com/	2ZsJ2iP8Q2.exe, 00000000.00000002.1491103778.0000000000B75000.00000004.00000020.00020000.00000000.sdmp	false	high
https://api.steampowered.com/	2ZsJ2iP8Q2.exe, 00000000.00000002.1491103778.0000000000B75000.00000004.00000020.00020000.00000000.sdmp	false	high
http://store.steampowered.com/account/cookiepreferences/	2ZsJ2iP8Q2.exe, 00000000.00000003.1456091842.0000000000AFB000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B84000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/mobile	2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steamcommunity.com/	2ZsJ2iP8Q2.exe, 00000000.00000002.1490977315.0000000000B37000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000002.1491103778.0000000000B75000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000002.1490977315.0000000000B02000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=_92TWn81	2ZsJ2iP8Q2.exe, 00000000.00000003.1456091842.0000000000AFB000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B84000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/;	2ZsJ2iP8Q2.exe, 00000000.00000003.1456329603.0000000000B75000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456091842.0000000000B37000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000002.1490977315.0000000000B37000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000002.1491103778.0000000000B75000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/about/	2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=gQHVlrK4-jX-&l	2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B89000.00000004.00000020.00020000.00000000.sdmp, 2ZsJ2iP8Q2.exe, 00000000.00000003.1456049863.0000000000B84000.00000004.00000020.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.102.49.254	steamcommunity.com	United States		16625	AKAMAI-ASUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1579789
Start date and time:	2024-12-23 09:08:37 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	2
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	2ZsJ2iP8Q2.exe renamed because original name is a hash value
Original Sample Name:	7884feeb676b85c98dbbe6a0e6f92cbc.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@10/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Excluded IPs from analysis (whitelisted): 52.149.20.212
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ocsp.edge.digicert.com, sls.update.microsoft.com, glb.sls.prod.dcat.dsp.trafficmanager.net
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
03:09:32	API Interceptor	5x Sleep call for process: 2ZsJ2iP8Q2.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.102.49.254	r4xiHKy8aM.exe	Get hash	malicious	Socks5Systemz	Browse	/ISteamUser/GetFriendList/v1/?key=AE2AE4DBF33A541E83BC08989DB1F397&steamid=76561198400860497
104.102.49.254	http://gtm-cn-j4g3qqvf603.steamproxy1.com/	Get hash	malicious	Unknown	Browse	www.valvesoftware.com/legal.htm

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
steamcommunity.com	LopCYSStr3.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	LNn56KMkEE.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	YYjRtxS70h.exe	Get hash	malicious	Unknown	Browse	104.102.49.254
	VBHyEN96Pw.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	BVGvbpplT8.exe	Get hash	malicious	LummaC, Stealc	Browse	104.102.49.254
	613vKYuY2S.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	YYjRtxS70h.exe	Get hash	malicious	Unknown	Browse	104.102.49.254
	mgEXk8ip26.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	44EPDJT1V8.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	Bire1g8ahY.exe	Get hash	malicious	LummaC, Stealc	Browse	104.102.49.254
fp2e7a.wpc.phicdn.net	BVGvbpplT8.exe	Get hash	malicious	LummaC, Stealc	Browse	192.229.221.95
	mgEXk8ip26.exe	Get hash	malicious	LummaC	Browse	192.229.221.95
	r4xiHKy8aM.exe	Get hash	malicious	Socks5Systemz	Browse	192.229.221.95
	dnf5RWZv2v.exe	Get hash	malicious	Unknown	Browse	192.229.221.95
	crhRJnVd08.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	192.229.221.95
	xWnpPJbKGK.exe	Get hash	malicious	Cryptbot	Browse	192.229.221.95
	skIYOAOzvU.exe	Get hash	malicious	LummaC	Browse	192.229.221.95
	1fgVMJOnF0.exe	Get hash	malicious	Cryptbot	Browse	192.229.221.95
	cred64.dll.dll	Get hash	malicious	Amadey	Browse	192.229.221.95
	tg.exe	Get hash	malicious	Babadeda	Browse	192.229.221.95

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASUS	LopCYSStr3.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	LNn56KMkEE.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	YYjRtxS70h.exe	Get hash	malicious	Unknown	Browse	104.102.49.254
	VBHyEN96Pw.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	BVGvbpplT8.exe	Get hash	malicious	LummaC, Stealc	Browse	104.102.49.254
	613vKYuY2S.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	YYjRtxS70h.exe	Get hash	malicious	Unknown	Browse	104.102.49.254
	mgEXk8ip26.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	44EPDJT1V8.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	Bire1g8ahY.exe	Get hash	malicious	LummaC, Stealc	Browse	104.102.49.254

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	LopCYSStr3.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	LNn56KMkEE.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	VBHyEN96Pw.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	BVGvbpplT8.exe	Get hash	malicious	LummaC, Stealc	Browse	104.102.49.254
	613vKYuY2S.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	FBVmDbz2nb.exe	Get hash	malicious	LummaC, Stealc	Browse	104.102.49.254
	mgEXk8ip26.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	44EPDJT1V8.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	Bire1g8ahY.exe	Get hash	malicious	LummaC, Stealc	Browse	104.102.49.254
	jSFUzuYPG9.exe	Get hash	malicious	LummaC	Browse	104.102.49.254

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.948257665459299
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	2ZsJ2iP8Q2.exe
File size:	1'825'280 bytes
MD5:	7884feeb676b85c98dbbe6a0e6f92cbc
SHA1:	897b3e60a77b96d2423525a6db8ccb386abeb14d
SHA256:	80e820374e64aba34f70f88c5d7d3ecf7967d833d1ab674d50379ee4034a30d0
SHA512:	99697017c1e6402cbd21795fa7c4ee1b3302558ae26d7e1e780d47257d4535a32a11da8d80504956d575407e0c5038808acec2aaa8ec9038084c0df32cdbaee2
SSDEEP:	49152:K4h8NFmxfLLAPDd/5n9hTRVlFJ3FJxMsIdows8W:KoWFmKF/hTnlFJ3F7yobp
TLSH:	CB8533187A2768EFC27CDFBBC02696061E753F7034AF5E3A5966A5F06D8300E7386605
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....<_g.............................@H...........@..........................pH...........@.................................T0..h..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x884000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x675F3CD1 [Sun Dec 15 20:32:17 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FEEFC7AD3AAh
popcnt ebx, dword ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [edx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x53054	0x68	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x52000	0x1ac	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x531f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x51000	0x24800	b3aec505fa48582941af35942af0896c	False	0.9973579302226028	data	7.984547595272886	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x52000	0x1ac	0x200	75720b8ea60aa06a31806981b744f74e	False	0.5390625	data	5.245569576626531	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x53000	0x1000	0x200	19a29171433eeef17e42fd663f137134	False	0.14453125	data	0.9996515881509258	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x54000	0x299000	0x200	8f7fa194fd79556e06771e22f21aab15	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ndhyrphp	0x2ed000	0x196000	0x195600	bf4d8d7d9ea7f299f13660c26a3811c3	False	0.9949434358618563	data	7.95457315735519	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ctngovzo	0x483000	0x1000	0x400	fe4df5f61eb9aaa0fc76d81be72da84b	False	0.7900390625	data	6.160683268448397	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x484000	0x3000	0x2200	1bc6769fddf799f04334785d642555da	False	0.05755974264705882	DOS executable (COM)	0.8102936093835253	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x52058	0x152	ASCII text, with CRLF line terminators			0.6479289940828402

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-23T09:09:32.847068+0100	2058378	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat)	1	192.168.2.8	64051	1.1.1.1	53	UDP
2024-12-23T09:09:32.999917+0100	2058364	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grannyejh .lat)	1	192.168.2.8	56783	1.1.1.1	53	UDP
2024-12-23T09:09:33.262726+0100	2058360	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (discokeyus .lat)	1	192.168.2.8	64751	1.1.1.1	53	UDP
2024-12-23T09:09:33.566723+0100	2058370	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacebudi .lat)	1	192.168.2.8	61074	1.1.1.1	53	UDP
2024-12-23T09:09:33.845893+0100	2058362	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (energyaffai .lat)	1	192.168.2.8	60902	1.1.1.1	53	UDP
2024-12-23T09:09:34.068057+0100	2058354	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (aspecteirs .lat)	1	192.168.2.8	63285	1.1.1.1	53	UDP
2024-12-23T09:09:34.378734+0100	2058376	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sustainskelet .lat)	1	192.168.2.8	57790	1.1.1.1	53	UDP
2024-12-23T09:09:34.600987+0100	2058358	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crosshuaht .lat)	1	192.168.2.8	49676	1.1.1.1	53	UDP
2024-12-23T09:09:34.821764+0100	2058374	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (rapeflowwj .lat)	1	192.168.2.8	64576	1.1.1.1	53	UDP
2024-12-23T09:09:36.670378+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49706	104.102.49.254	443	TCP
2024-12-23T09:09:37.621179+0100	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.8	49706	104.102.49.254	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 23, 2024 09:09:35.280806065 CET	49706	443	192.168.2.8	104.102.49.254
Dec 23, 2024 09:09:35.280854940 CET	443	49706	104.102.49.254	192.168.2.8
Dec 23, 2024 09:09:35.281184912 CET	49706	443	192.168.2.8	104.102.49.254
Dec 23, 2024 09:09:35.284686089 CET	49706	443	192.168.2.8	104.102.49.254
Dec 23, 2024 09:09:35.284704924 CET	443	49706	104.102.49.254	192.168.2.8
Dec 23, 2024 09:09:36.670228958 CET	443	49706	104.102.49.254	192.168.2.8
Dec 23, 2024 09:09:36.670377970 CET	49706	443	192.168.2.8	104.102.49.254
Dec 23, 2024 09:09:36.700413942 CET	49706	443	192.168.2.8	104.102.49.254
Dec 23, 2024 09:09:36.700442076 CET	443	49706	104.102.49.254	192.168.2.8
Dec 23, 2024 09:09:36.700777054 CET	443	49706	104.102.49.254	192.168.2.8
Dec 23, 2024 09:09:36.752407074 CET	49706	443	192.168.2.8	104.102.49.254
Dec 23, 2024 09:09:36.796695948 CET	49706	443	192.168.2.8	104.102.49.254
Dec 23, 2024 09:09:36.839375019 CET	443	49706	104.102.49.254	192.168.2.8
Dec 23, 2024 09:09:37.621218920 CET	443	49706	104.102.49.254	192.168.2.8
Dec 23, 2024 09:09:37.621238947 CET	443	49706	104.102.49.254	192.168.2.8
Dec 23, 2024 09:09:37.621247053 CET	443	49706	104.102.49.254	192.168.2.8
Dec 23, 2024 09:09:37.621269941 CET	443	49706	104.102.49.254	192.168.2.8
Dec 23, 2024 09:09:37.621279955 CET	443	49706	104.102.49.254	192.168.2.8
Dec 23, 2024 09:09:37.621351004 CET	49706	443	192.168.2.8	104.102.49.254
Dec 23, 2024 09:09:37.621351004 CET	49706	443	192.168.2.8	104.102.49.254
Dec 23, 2024 09:09:37.621366024 CET	443	49706	104.102.49.254	192.168.2.8
Dec 23, 2024 09:09:37.621473074 CET	49706	443	192.168.2.8	104.102.49.254
Dec 23, 2024 09:09:37.736269951 CET	443	49706	104.102.49.254	192.168.2.8
Dec 23, 2024 09:09:37.736346006 CET	443	49706	104.102.49.254	192.168.2.8
Dec 23, 2024 09:09:37.736361027 CET	443	49706	104.102.49.254	192.168.2.8
Dec 23, 2024 09:09:37.736541986 CET	49706	443	192.168.2.8	104.102.49.254
Dec 23, 2024 09:09:37.736541986 CET	49706	443	192.168.2.8	104.102.49.254
Dec 23, 2024 09:09:37.737845898 CET	49706	443	192.168.2.8	104.102.49.254
Dec 23, 2024 09:09:37.737860918 CET	443	49706	104.102.49.254	192.168.2.8

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 23, 2024 09:09:32.847068071 CET	64051	53	192.168.2.8	1.1.1.1
Dec 23, 2024 09:09:32.985850096 CET	53	64051	1.1.1.1	192.168.2.8
Dec 23, 2024 09:09:32.999917030 CET	56783	53	192.168.2.8	1.1.1.1
Dec 23, 2024 09:09:33.221218109 CET	53	56783	1.1.1.1	192.168.2.8
Dec 23, 2024 09:09:33.262726068 CET	64751	53	192.168.2.8	1.1.1.1
Dec 23, 2024 09:09:33.564435005 CET	53	64751	1.1.1.1	192.168.2.8
Dec 23, 2024 09:09:33.566723108 CET	61074	53	192.168.2.8	1.1.1.1
Dec 23, 2024 09:09:33.790409088 CET	53	61074	1.1.1.1	192.168.2.8
Dec 23, 2024 09:09:33.845892906 CET	60902	53	192.168.2.8	1.1.1.1
Dec 23, 2024 09:09:34.066448927 CET	53	60902	1.1.1.1	192.168.2.8
Dec 23, 2024 09:09:34.068057060 CET	63285	53	192.168.2.8	1.1.1.1
Dec 23, 2024 09:09:34.376768112 CET	53	63285	1.1.1.1	192.168.2.8
Dec 23, 2024 09:09:34.378734112 CET	57790	53	192.168.2.8	1.1.1.1
Dec 23, 2024 09:09:34.597846985 CET	53	57790	1.1.1.1	192.168.2.8
Dec 23, 2024 09:09:34.600986958 CET	49676	53	192.168.2.8	1.1.1.1
Dec 23, 2024 09:09:34.818921089 CET	53	49676	1.1.1.1	192.168.2.8
Dec 23, 2024 09:09:34.821763992 CET	64576	53	192.168.2.8	1.1.1.1
Dec 23, 2024 09:09:35.046772957 CET	53	64576	1.1.1.1	192.168.2.8
Dec 23, 2024 09:09:35.049789906 CET	59880	53	192.168.2.8	1.1.1.1
Dec 23, 2024 09:09:35.275343895 CET	53	59880	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 23, 2024 09:09:32.847068071 CET	192.168.2.8	1.1.1.1	0xa3e1	Standard query (0)	sweepyribs.lat	A (IP address)	IN (0x0001)	false
Dec 23, 2024 09:09:32.999917030 CET	192.168.2.8	1.1.1.1	0xe248	Standard query (0)	grannyejh.lat	A (IP address)	IN (0x0001)	false
Dec 23, 2024 09:09:33.262726068 CET	192.168.2.8	1.1.1.1	0xcf5a	Standard query (0)	discokeyus.lat	A (IP address)	IN (0x0001)	false
Dec 23, 2024 09:09:33.566723108 CET	192.168.2.8	1.1.1.1	0x4e40	Standard query (0)	necklacebudi.lat	A (IP address)	IN (0x0001)	false
Dec 23, 2024 09:09:33.845892906 CET	192.168.2.8	1.1.1.1	0xced3	Standard query (0)	energyaffai.lat	A (IP address)	IN (0x0001)	false
Dec 23, 2024 09:09:34.068057060 CET	192.168.2.8	1.1.1.1	0xac23	Standard query (0)	aspecteirs.lat	A (IP address)	IN (0x0001)	false
Dec 23, 2024 09:09:34.378734112 CET	192.168.2.8	1.1.1.1	0xd77e	Standard query (0)	sustainskelet.lat	A (IP address)	IN (0x0001)	false
Dec 23, 2024 09:09:34.600986958 CET	192.168.2.8	1.1.1.1	0x3549	Standard query (0)	crosshuaht.lat	A (IP address)	IN (0x0001)	false
Dec 23, 2024 09:09:34.821763992 CET	192.168.2.8	1.1.1.1	0x4a99	Standard query (0)	rapeflowwj.lat	A (IP address)	IN (0x0001)	false
Dec 23, 2024 09:09:35.049789906 CET	192.168.2.8	1.1.1.1	0xc435	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 23, 2024 09:09:32.985850096 CET	1.1.1.1	192.168.2.8	0xa3e1	Name error (3)	sweepyribs.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 09:09:33.221218109 CET	1.1.1.1	192.168.2.8	0xe248	Name error (3)	grannyejh.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 09:09:33.564435005 CET	1.1.1.1	192.168.2.8	0xcf5a	Name error (3)	discokeyus.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 09:09:33.790409088 CET	1.1.1.1	192.168.2.8	0x4e40	Name error (3)	necklacebudi.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 09:09:34.066448927 CET	1.1.1.1	192.168.2.8	0xced3	Name error (3)	energyaffai.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 09:09:34.376768112 CET	1.1.1.1	192.168.2.8	0xac23	Name error (3)	aspecteirs.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 09:09:34.597846985 CET	1.1.1.1	192.168.2.8	0xd77e	Name error (3)	sustainskelet.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 09:09:34.818921089 CET	1.1.1.1	192.168.2.8	0x3549	Name error (3)	crosshuaht.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 09:09:35.046772957 CET	1.1.1.1	192.168.2.8	0x4a99	Name error (3)	rapeflowwj.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 09:09:35.275343895 CET	1.1.1.1	192.168.2.8	0xc435	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false
Dec 23, 2024 09:09:49.119139910 CET	1.1.1.1	192.168.2.8	0x512b	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 23, 2024 09:09:49.119139910 CET	1.1.1.1	192.168.2.8	0x512b	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49706	104.102.49.254	443	4468	C:\Users\user\Desktop\2ZsJ2iP8Q2.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 08:09:36 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-12-23 08:09:37 UTC	1905	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Mon, 23 Dec 2024 08:09:37 GMT Content-Length: 25665 Connection: close Set-Cookie: sessionid=08097025d33d9dd43aaddf04; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=None
2024-12-23 08:09:37 UTC	14479	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0a 09 09 3c 74 69 74 6c 65 3e Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><title>
2024-12-23 08:09:37 UTC	11186	IN	Data Raw: 3f 6c 3d 6b 6f 72 65 61 6e 61 22 20 6f 6e 63 6c 69 63 6b 3d 22 43 68 61 6e 67 65 4c 61 6e 67 75 61 67 65 28 20 27 6b 6f 72 65 61 6e 61 27 20 29 3b 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 22 3e ed 95 9c ea b5 ad ec 96 b4 20 28 4b 6f 72 65 61 6e 29 3c 2f 61 3e 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 6d 65 6e 75 5f 69 74 65 6d 20 74 69 67 68 74 22 20 68 72 65 66 3d 22 3f 6c 3d 74 68 61 69 22 20 6f 6e 63 6c 69 63 6b 3d 22 43 68 61 6e 67 65 4c 61 6e 67 75 61 67 65 28 20 27 74 68 61 69 27 20 29 3b 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 22 3e e0 b9 84 e0 b8 97 e0 b8 a2 20 28 54 68 61 69 29 3c 2f 61 3e 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 Data Ascii: ?l=koreana" onclick="ChangeLanguage( 'koreana' ); return false;"> (Korean)</a><a class="popup_menu_item tight" href="?l=thai" onclick="ChangeLanguage( 'thai' ); return false;"> (Thai)</a>

Target ID:	0
Start time:	03:09:30
Start date:	23/12/2024
Path:	C:\Users\user\Desktop\2ZsJ2iP8Q2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\2ZsJ2iP8Q2.exe"
Imagebase:	0xfb0000
File size:	1'825'280 bytes
MD5 hash:	7884FEEB676B85C98DBBE6A0E6F92CBC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	29%
Total number of Nodes:	62
Total number of Limit Nodes:	4

Executed Functions

Function 00FBACF0 Relevance: 9.2, Strings: 7, Instructions: 430
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

'sZu, xrefs: 00FBADCD
e7o9, xrefs: 00FBAF9F
&wXy, xrefs: 00FBADD4
Jk"m, xrefs: 00FBADF7
h? !, xrefs: 00FBAFB3
&K M, xrefs: 00FBADBF
/O_q, xrefs: 00FBADC6

Memory Dump Source

Source File: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID: &K M$&wXy$'sZu$/O_q$Jk"m$e7o9$h? !
API String ID: 0-2986092683
Opcode ID: d484a3503149c501121e8528959e918871db6763ff8d5698f15e2c8c58b3f570
Instruction ID: eb620fc4ae6b0ef5868853a84fe08a697d8b6c7dcd97c822b985c2423b850f7b
Opcode Fuzzy Hash: d484a3503149c501121e8528959e918871db6763ff8d5698f15e2c8c58b3f570
Instruction Fuzzy Hash: 4F0254B1200B05CFD3248F25D895BA7BBF5FF44314F188A2CE5AA8BAA0D7B5A545DF40

Function 00FB8850 Relevance: 1.7, APIs: 1, Instructions: 208
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(00000000), ref: 00FB8AD2

Part of subcall function 00FBB390: FreeLibrary.KERNEL32(00FB8AB8), ref: 00FBB396
Part of subcall function 00FBB390: FreeLibrary.KERNEL32 ref: 00FBB3B7

Memory Dump Source

Source File: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID: FreeLibrary$ExitProcess
String ID:
API String ID: 1614911148-0
Opcode ID: c5d1e7479fa1b410fb4bc9aa57e92e7e51b902e591d53ad8a55fff04b10e2e2f
Instruction ID: 82054074ac9277d730a7bd823d8cf7e344b813e9a3c03a5d85d843f7a153c3aa
Opcode Fuzzy Hash: c5d1e7479fa1b410fb4bc9aa57e92e7e51b902e591d53ad8a55fff04b10e2e2f
Instruction Fuzzy Hash: 15518BB7F102181BD71CAEAA8C567A6758B8BC5760F1F813E5940DF3D6EDB88C0692C1

Function 00FEC1F0 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(00FEE31B,005C003F,0000002C,?,?,00000018,?,00000000,?,?,?,?,00000000,00000000), ref: 00FEC21E

Memory Dump Source

Source File: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 00FEC767 Relevance: 1.3, Strings: 1, Instructions: 99COMMON

Download Yara Rule

Strings

,+*), xrefs: 00FEC790

Memory Dump Source

Source File: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID: ,+*)
API String ID: 0-3529585375
Opcode ID: 96225b18e5d66a1b9e7fd14939882aafa524c5d9a9a576529940cd03d2ef6b8a
Instruction ID: 93086b342ebf770ecd586205176b6c389e5de3cf09eb0891399129be80b638a1
Opcode Fuzzy Hash: 96225b18e5d66a1b9e7fd14939882aafa524c5d9a9a576529940cd03d2ef6b8a
Instruction Fuzzy Hash: 0A31B635B402159FEB18CF58CD91BBEB7B2BB49300F249128E501A73D0CB75AD02DB90

Function 00FBB70C Relevance: 1.3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

Strings

o`, xrefs: 00FBB74B

Memory Dump Source

Source File: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID: o`
API String ID: 0-3993896143
Opcode ID: e5a720eee114fcc3dea7f0ebd1444bc31c8c9f1f0679e019673a4c4ed571661c
Instruction ID: 3bf0827e6c62a111c379a93fe333e1d46ee22fc2e110b0b1a55a87773f466745
Opcode Fuzzy Hash: e5a720eee114fcc3dea7f0ebd1444bc31c8c9f1f0679e019673a4c4ed571661c
Instruction Fuzzy Hash: 1F11CE70218384AFC3009F65DDC1B6BBFE2ABC2204F64983DE181EB261C675E949EB15

Function 00FB9C4A Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9643fcc2623928cbce544d877a9dc2a0d7ef1901f9e49310a71e552730a7d19d
Instruction ID: 71aabc74eda6661370c77cc5b427aadb71227087369bbfd5fa97891b8bb25441
Opcode Fuzzy Hash: 9643fcc2623928cbce544d877a9dc2a0d7ef1901f9e49310a71e552730a7d19d
Instruction Fuzzy Hash: FB11E271A8D3448FD304DF6999812BBBBE2DFD6310F08552DE1D1AB351C6B4990E9B06

Function 00FEC180 Relevance: 1.5, APIs: 1, Instructions: 35
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlReAllocateHeap.NTDLL(?,00000000,?,00000000,?,?,00FBB2E4,00000000,00000001), ref: 00FEC1B2

Memory Dump Source

Source File: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: cc6f06fd23f24e8ad7bf5a40ba1a9273b1d6e69d082f657452fb1920758a3c02
Instruction ID: 2183e4c39a7c73c0276c362c164f92b15a85a06fbfa179e670730d4da3f5d70d
Opcode Fuzzy Hash: cc6f06fd23f24e8ad7bf5a40ba1a9273b1d6e69d082f657452fb1920758a3c02
Instruction Fuzzy Hash: 4BF0E973408351EBC2143F297C01EA776A89F86B20F024475F80151111E73EE412F5E3

Function 00FEAAA0 Relevance: 1.5, APIs: 1, Instructions: 13
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(?,00000000,?,00FEC1D6,?,00FBB2E4,00000000,00000001), ref: 00FEAABE

Memory Dump Source

Source File: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 0bf217d9fa6075422245440848af8e626f29315e5ab08fa11379944064d1f9f8
Instruction ID: e731a6215c56d698f79958a850dc724497c777c0361b07120f51442bf5e1573a
Opcode Fuzzy Hash: 0bf217d9fa6075422245440848af8e626f29315e5ab08fa11379944064d1f9f8
Instruction Fuzzy Hash: 2AD01231505122EBC7112F28FC06B963B9CEF0A760F074861B4406B075C675DD91DAD0

Function 00FEAA80 Relevance: 1.5, APIs: 1, Instructions: 9
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,?,00FEC1C0), ref: 00FEAA90

Memory Dump Source

Source File: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: c16f67aa7d7e53eaccdc83c13da134f4c99383ab3a6b494bc62911830f30a621
Instruction ID: d0deccb69fca12339b6a74e5dfa081c54efa512a86b268ac20fdbc674ac8b7bc
Opcode Fuzzy Hash: c16f67aa7d7e53eaccdc83c13da134f4c99383ab3a6b494bc62911830f30a621
Instruction Fuzzy Hash: 42C09231045160ABCA252B16FC09FCA3F68EF45761F0244A2F444670B6C776AC92DBD4

Function 010080F2 Relevance: 1.3, APIs: 1, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 01008112

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 20f1ec707ed9b0755a75c36c81be7e73aa25fd8fa185d949c28dc7ac8bd0bbb7
Instruction ID: 1387e005cf46c5bf363c7c0a7a7d565bf2d83a20c32f42a3fcacbbe78340e81d
Opcode Fuzzy Hash: 20f1ec707ed9b0755a75c36c81be7e73aa25fd8fa185d949c28dc7ac8bd0bbb7
Instruction Fuzzy Hash: 12F0A5B4508609DFEB116F64D884A6EBBB4EF48721F018A1DEDD546B90D3764C60CF16

Function 01008858 Relevance: 1.3, APIs: 1, Instructions: 4memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 01008858

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: da8bd3ba6b33383f7c42649fc750c6727299491fe805c455b2ace8c0157b9639
Instruction ID: 64ea006f3181e930058c1a1dd6160ca2999e7ab878283ba4272f977accd2fdc3
Opcode Fuzzy Hash: da8bd3ba6b33383f7c42649fc750c6727299491fe805c455b2ace8c0157b9639
Instruction Fuzzy Hash: 12B0123084411ECB57484F5044041EE3610F950103F50C2035C1281600D3B24C10C909

Non-executed Functions

Function 00FD41C0 Relevance: 24.8, Strings: 19, Instructions: 1025COMMON

Download Yara Rule

Strings

:JL, xrefs: 00FD4BF5
?z=|, xrefs: 00FD47D8
<[5], xrefs: 00FD4902
-^+P, xrefs: 00FD4832
#f!x, xrefs: 00FD4BC3
A/6Q, xrefs: 00FD48E4
8JL, xrefs: 00FD4800
o#M%, xrefs: 00FD48C6
$%, xrefs: 00FD4257
5F6X, xrefs: 00FD4C13
6T, xrefs: 00FD4D0A
)Z/\, xrefs: 00FD4C1D
VaUc, xrefs: 00FD459C
%y, xrefs: 00FD4D14
pIrK, xrefs: 00FD4560
7, xrefs: 00FD4D00
>N@, xrefs: 00FD480A
)Z*\, xrefs: 00FD4828
=_%A, xrefs: 00FD490C

Memory Dump Source

Source File: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID: #f!x$$%$%y$)Z*\$)Z/\$-^+P$5F6X$6T$7$8JL$:JL$<[5]$=_%A$>N@$?z=|$A/6Q$VaUc$o#M%$pIrK
API String ID: 0-2905094782
Opcode ID: b083d3221cd9dbda1aa480ee76472edabcaf9917c3ab74fd3773bbcbfe78681c
Instruction ID: 3e4fa5b6723e5fa4ede909f621af9213d1a33cff58221ae098db11d6d8ad2d09
Opcode Fuzzy Hash: b083d3221cd9dbda1aa480ee76472edabcaf9917c3ab74fd3773bbcbfe78681c
Instruction Fuzzy Hash: AF9296B59052298BDB24CF59DC887EEBB72FF84300F2482E9D4596B350DB755A86CF80

Function 00FD4380 Relevance: 23.4, Strings: 18, Instructions: 948COMMON

Download Yara Rule

Strings

:JL, xrefs: 00FD4BF5
?z=|, xrefs: 00FD47D8
<[5], xrefs: 00FD4902
-^+P, xrefs: 00FD4832
#f!x, xrefs: 00FD4BC3
A/6Q, xrefs: 00FD48E4
8JL, xrefs: 00FD4800
o#M%, xrefs: 00FD48C6
5F6X, xrefs: 00FD4C13
6T, xrefs: 00FD4D0A
)Z/\, xrefs: 00FD4C1D
VaUc, xrefs: 00FD459C
%y, xrefs: 00FD4D14
pIrK, xrefs: 00FD4560
7, xrefs: 00FD4D00
>N@, xrefs: 00FD480A
)Z*\, xrefs: 00FD4828
=_%A, xrefs: 00FD490C

Memory Dump Source

Source File: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID: #f!x$%y$)Z*\$)Z/\$-^+P$5F6X$6T$7$8JL$:JL$<[5]$=_%A$>N@$?z=|$A/6Q$VaUc$o#M%$pIrK
API String ID: 0-3225404442
Opcode ID: e47211f5496652cfe4d6180f41f8f28d2f1672b3d8cb8dc8bdf943f0357b1f85
Instruction ID: e2c7aed85ed65067434800574cd38c5a4536dfb681c3a450d1de1017215e73ac
Opcode Fuzzy Hash: e47211f5496652cfe4d6180f41f8f28d2f1672b3d8cb8dc8bdf943f0357b1f85
Instruction Fuzzy Hash: 6B9296B5905269CBDB24CF59D8887EEBB72FF84300F2482E9D4596B350DB745A86CF80

Function 0116E5C8 Relevance: 16.6, Strings: 12, Instructions: 1592COMMON

Download Yara Rule

Strings

o(_/, xrefs: 0116EE53
n,z{, xrefs: 0116F282
Sn7, xrefs: 0116F178
;W:_, xrefs: 0116F8C5
@j{., xrefs: 0116E97D
@v, xrefs: 0116ED3C
cwm, xrefs: 0116F01D
VQ~j, xrefs: 0116F409
n,z{, xrefs: 0116F268
h-?, xrefs: 0116F15E
gLW~, xrefs: 0116F148
u@yy, xrefs: 0116EE7D

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID: ;W:_$@j{.$Sn7$VQ~j$gLW~$h-?$n,z{$n,z{$o(_/$u@yy$cwm$@v
API String ID: 0-1672458172
Opcode ID: 172363ed9ed6f753bcc167029c078fb4669b9f42b81f9e201f3379baab5c150b
Instruction ID: f4aef180721a4041d1094ea4388bf9d69a5c1c9949acd33b92cf0e3e34190279
Opcode Fuzzy Hash: 172363ed9ed6f753bcc167029c078fb4669b9f42b81f9e201f3379baab5c150b
Instruction Fuzzy Hash: 82B205F390C2149FE3046E29EC8567ABBE9EF94720F16893DEAC5C3744EA3558048797

Function 00FB91B0 Relevance: 15.4, Strings: 12, Instructions: 368COMMON

Download Yara Rule

Strings

bblg, xrefs: 00FB928C
gn~b, xrefs: 00FB927C
$01;, xrefs: 00FB91E1
", xrefs: 00FB931D
O35 , xrefs: 00FB9240
w!w4, xrefs: 00FB91F1
>7;<, xrefs: 00FB91F9
908#, xrefs: 00FB91E9
!+2j, xrefs: 00FB91C9
(7.A, xrefs: 00FB92DC
ne, xrefs: 00FB9209
vm/;, xrefs: 00FB91D9

Memory Dump Source

Source File: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID: !+2j$"$$01;$(7.A$908#$>7;<$O35 $bblg$gn~b$ne$vm/;$w!w4
API String ID: 0-1290103930
Opcode ID: e76aa1fc780e58e750d1ae106741ee0e38235b05f912ede24168565961e5c466
Instruction ID: 90a6aae179ece42ea2493d991c84ab40adadbea579439208fa0e8f35acf87745
Opcode Fuzzy Hash: e76aa1fc780e58e750d1ae106741ee0e38235b05f912ede24168565961e5c466
Instruction Fuzzy Hash: 08A1F77064C3D18BC316CF7A84A07ABBFE0AF97314F58496CE5D54B282D3798906DB62

Function 00FB9580 Relevance: 7.9, Strings: 6, Instructions: 442COMMON

Download Yara Rule

Strings

+8=>, xrefs: 00FB9782
PK, xrefs: 00FB99E1
#4<7, xrefs: 00FB9772
r, xrefs: 00FB95F4
\, xrefs: 00FB978A
Tiec, xrefs: 00FB9963

Memory Dump Source

Source File: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID: #4<7$+8=>$PK$Tiec$\$r
API String ID: 0-1906979145
Opcode ID: d6006da7dfdc3f52b59bf67bac863caf33b638adf8eb40577660bacc3b455011
Instruction ID: 6cc4b94406d1bd2df80370cd157f9d47ce36ac5b441b08010b4d9ad51da28323
Opcode Fuzzy Hash: d6006da7dfdc3f52b59bf67bac863caf33b638adf8eb40577660bacc3b455011
Instruction Fuzzy Hash: C9D13476A0C3408BD318CF25C8916AFBBE6EFD1318F18992DE5E69B251D778C905CB42

Function 0106E4DF Relevance: 4.3, Strings: 3, Instructions: 572COMMON

Download Yara Rule

Strings

OPw, xrefs: 0106ECE8
gH_;, xrefs: 0106EB2C
O7o, xrefs: 0106EA5D

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID: O7o$OPw$gH_;
API String ID: 0-2213915942
Opcode ID: 3fab61f8bac63f2e2611b45114edd741006c37a8d3c91e46737e03e8a54eb74c
Instruction ID: c9120e22046f473dab4d75ed03c32a651c3b40cbbd0db80443e0ea55a3cd720e
Opcode Fuzzy Hash: 3fab61f8bac63f2e2611b45114edd741006c37a8d3c91e46737e03e8a54eb74c
Instruction Fuzzy Hash: AB120FF3F156204BF3484929CC99366B693EBD4320F2F823C9A99A77C5D93E9D064384

Function 010253EC Relevance: 4.2, Strings: 3, Instructions: 500COMMON

Download Yara Rule

Strings

~{G, xrefs: 01025851
^|s>, xrefs: 01025981
^x'., xrefs: 0102598A

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID: ^x'.$^|s>$~{G
API String ID: 0-1930737422
Opcode ID: 31af883de255583f28dcbd4973e086123adab8f2ff01d1ee6119c3d6e8fd7c11
Instruction ID: 0aaae8a45c6c55d6fbb5c4c4290f7aa5c8a42d3a5b01bc831119762773638139
Opcode Fuzzy Hash: 31af883de255583f28dcbd4973e086123adab8f2ff01d1ee6119c3d6e8fd7c11
Instruction Fuzzy Hash: 4BF1EEB3F142254BF3045D68DC98366B696EB95324F2F423DCE88AB7C5E97E5C068384

Function 00FD2510 Relevance: 4.2, Strings: 3, Instructions: 454COMMON

Download Yara Rule

Strings

<pr, xrefs: 00FD2536
y./, xrefs: 00FD2715
st, xrefs: 00FD253E

Memory Dump Source

Source File: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID: <pr$st$y./
API String ID: 0-3839595785
Opcode ID: 3a14e41450a1a8353a0f64e5d46cad7071a303fe9aed7348458c7fc5842959d5
Instruction ID: 3a4878664db0c5853a141455d75e69c781927f747b247ad69575de27af3b749e
Opcode Fuzzy Hash: 3a14e41450a1a8353a0f64e5d46cad7071a303fe9aed7348458c7fc5842959d5
Instruction Fuzzy Hash: FAC15972A043004BD7649F25C85277BB7E2EFE4360F1D852EE89687381E678D805E7D2

Function 00FCD380 Relevance: 4.2, Strings: 3, Instructions: 453COMMON

Download Yara Rule

Strings

34, xrefs: 00FCD46A
|F, xrefs: 00FCD40A
C], xrefs: 00FCD471

Memory Dump Source

Source File: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID: 34$C]$|F
API String ID: 0-2804560523
Opcode ID: 244f0cbd1ad4f3258f74e75b5012187c754bf8ea21d8b669960632ceed748721
Instruction ID: fa0c097528fcaa0d6fa48bc9019afc10da1a5ee78a039a4348673b1580524e62
Opcode Fuzzy Hash: 244f0cbd1ad4f3258f74e75b5012187c754bf8ea21d8b669960632ceed748721
Instruction Fuzzy Hash: 75C1F0759183128BC324DF18C882B6BB7F2FF95314F58896CE8D58B390E774A905D792

Function 00FDC3FC Relevance: 4.1, Strings: 3, Instructions: 311COMMON

Download Yara Rule

Strings

Hnd, xrefs: 00FDC440
A, xrefs: 00FDC51C
yszp, xrefs: 00FDC689

Memory Dump Source

Source File: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID: A$Hnd$yszp
API String ID: 0-2830101580
Opcode ID: 65b1f18a9041671a841e39c04c936252be3236abed8285f6e4d3122dc68fa368
Instruction ID: 862c16fe57c717b771de12888999080a2cd41fbbf50842a600fe91fb863d3ad3
Opcode Fuzzy Hash: 65b1f18a9041671a841e39c04c936252be3236abed8285f6e4d3122dc68fa368
Instruction Fuzzy Hash: 72A1F07190C3D18BD735CF3984607ABBBE2AF97310F1889AED4C99B342D6758405DB92

Function 00FCB2E0 Relevance: 4.0, Strings: 3, Instructions: 231COMMON

Download Yara Rule

Strings

+|-~, xrefs: 00FCB306
/pqr, xrefs: 00FCB30E
_, xrefs: 00FCB428

Memory Dump Source

Source File: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID: +|-~$/pqr$_
API String ID: 0-1379640984
Opcode ID: 2684abc4a1c6cebeea401bcca2d959b6ad67f3101dc4814653414480289ed14a
Instruction ID: a2b9eb79be4399358ab1062f0f1f4e4ad792d5d6bc356b2a2e3f330e9fc05175
Opcode Fuzzy Hash: 2684abc4a1c6cebeea401bcca2d959b6ad67f3101dc4814653414480289ed14a
Instruction Fuzzy Hash: A181381661419146CB2CDF3488A733BBAD7AFC4308B3991BEC565CFA97E938C1038B49

Function 00FC759F Relevance: 3.2, Strings: 2, Instructions: 671COMMON

Download Yara Rule

Strings

i, xrefs: 00FC7B2A
gfff, xrefs: 00FC7747

Memory Dump Source

Source File: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID: gfff$i
API String ID: 0-634403771
Opcode ID: be926572e5dd89e966403ee09677bf9b253765c26839adf145395967101b8d45
Instruction ID: facb6303bf800af2162e8bb338eb8a41e8993c7778bd066e2f10a1e3a530212c
Opcode Fuzzy Hash: be926572e5dd89e966403ee09677bf9b253765c26839adf145395967101b8d45
Instruction Fuzzy Hash: 39026972A0C3528BD324DF29DC82B7BBBD6EFD1310F19842DD485972A2DB749905DB82

Function 01165336 Relevance: 3.0, Strings: 2, Instructions: 450COMMON

Download Yara Rule

Strings

/xw, xrefs: 0116583E
j<Yt, xrefs: 01165655

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID: j<Yt$/xw
API String ID: 0-3860979271
Opcode ID: bb957e359796a700d98effe6fa82f572141437d83aed4c0b9eaef16cb0392857
Instruction ID: 95745e941334ed5234551ee759b10e369079bbd15f262a77b97c3059ff92a251
Opcode Fuzzy Hash: bb957e359796a700d98effe6fa82f572141437d83aed4c0b9eaef16cb0392857
Instruction Fuzzy Hash: 41E115F3A086009FE3046F29EC8567AFBE9EF94620F16493DE6C587744EA3599048793

Function 00FB4320 Relevance: 2.8, Strings: 2, Instructions: 329COMMON

Download Yara Rule

Strings

), xrefs: 00FB439B
IEND, xrefs: 00FB4711

Memory Dump Source

Source File: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID: )$IEND
API String ID: 0-707183367
Opcode ID: 4e346039619a168543b9fb1177b6fd0c4d4f452df85906f82a763f720f902fdd
Instruction ID: 2a40cba95c0b8fcba03d4748f79e897c2d575b5c24432567a8e17b297885bc00
Opcode Fuzzy Hash: 4e346039619a168543b9fb1177b6fd0c4d4f452df85906f82a763f720f902fdd
Instruction Fuzzy Hash: 69D1DEB1A083449FD720DF19CD8179EBBE4AB94344F14482DF9989B382D778E908DF92

Function 00FDA33F Relevance: 2.7, Strings: 2, Instructions: 211COMMON

Download Yara Rule

Strings

d, xrefs: 00FDA047
d, xrefs: 00FDA10D

Memory Dump Source

Source File: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID: d$d
API String ID: 0-195624457
Opcode ID: 4320aba1b02113781539d59c881b594aecb4af12028bba89697e1f239af585c5
Instruction ID: 6a759e6069fa5a06baa17e5347690f7918257a80928d2f465a9ab03ac992f418
Opcode Fuzzy Hash: 4320aba1b02113781539d59c881b594aecb4af12028bba89697e1f239af585c5
Instruction Fuzzy Hash: 215126329083248BC314CF24D89066BB7E6AFC9714F198A6DE8C9A7361D7369D05DB87

Function 00FC8591 Relevance: 2.6, Strings: 2, Instructions: 115COMMON

Download Yara Rule

Strings

P<?, xrefs: 00FC8680
P<?, xrefs: 00FC8590

Memory Dump Source

Source File: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID: P<?$P<?
API String ID: 0-3449142988
Opcode ID: 74695871ea63d0662956e4ea71e814d9a1b5a6ea687583c32edca087365fa88b
Instruction ID: b5173e06df0dbd29375124dd07e33a0be18982640bb90bac096c59d14a9d6a2c
Opcode Fuzzy Hash: 74695871ea63d0662956e4ea71e814d9a1b5a6ea687583c32edca087365fa88b
Instruction Fuzzy Hash: D9314676E48251EFC3208F58C981FBAB7A6AB84350F58D82DD5C9A3211DB706842E792

Function 00FD5327 Relevance: 2.0, Strings: 1, Instructions: 742COMMON

Download Yara Rule

Strings

"51s, xrefs: 00FD53CB

Memory Dump Source

Source File: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID: "51s
API String ID: 0-110016742
Opcode ID: cad307ace2456421e0992d4e9f10925f5f2760b4423eb3b93e494ac5b94f8d9f
Instruction ID: acfde647656f19ea654bb253865694a456a964acdc42075185945eb934884dce
Opcode Fuzzy Hash: cad307ace2456421e0992d4e9f10925f5f2760b4423eb3b93e494ac5b94f8d9f
Instruction Fuzzy Hash: 45320536E00616CBCB24CF68C8915BEB3B3FF89711B6D856DD482AB364DB35A941DB40

Function 00FEB1D0 Relevance: 1.9, Strings: 1, Instructions: 653COMMON

Download Yara Rule

Strings

f, xrefs: 00FEB3F1

Memory Dump Source

Source File: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID: InitializeThunk
String ID: f
API String ID: 2994545307-1993550816
Opcode ID: d34c632889bbd59600f1444d40e0b7e5fdd28f28761d0c99afb3623bf1d03430
Instruction ID: 45e0dc0e3cf8c1ed59e9362543f78d2c9a0bffe92ed8c3a981e8159d7876f3a7
Opcode Fuzzy Hash: d34c632889bbd59600f1444d40e0b7e5fdd28f28761d0c99afb3623bf1d03430
Instruction Fuzzy Hash: B612C131A083818FC715CF29D88162BB7E6AFC9324F248A2DE595972A2D770DD05DB92

Function 010653D6 Relevance: 1.7, Strings: 1, Instructions: 447COMMON

Download Yara Rule

Strings

y}~, xrefs: 010657E9

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID: y}~
API String ID: 0-2463155627
Opcode ID: 2c24e0f7b8e91678597c5f6a48d4b170f8be654263431f6727ca37c0def01167
Instruction ID: 902a41dbb28a29b74f45e382033a20b7b0d753dccf4fe666340eb6acb48b8c0c
Opcode Fuzzy Hash: 2c24e0f7b8e91678597c5f6a48d4b170f8be654263431f6727ca37c0def01167
Instruction Fuzzy Hash: 0DE1F2B3F146184BF3445E29DC98366B792EBD4710F2F423DDA8897784E93A9C068385

Function 010BB231 Relevance: 1.6, Strings: 1, Instructions: 325COMMON

Download Yara Rule

Strings

H, xrefs: 010BB497

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID: H
API String ID: 0-2852464175
Opcode ID: 6a3d5780f9b8c7236c4ed42eed2505d1f3219b88ab48a0de134c87978d8a07fc
Instruction ID: 1b09e169dd409f016793dd2c33ffd6e8214983144cc36a94f5f92935c8d5f08d
Opcode Fuzzy Hash: 6a3d5780f9b8c7236c4ed42eed2505d1f3219b88ab48a0de134c87978d8a07fc
Instruction Fuzzy Hash: D4B18CB3F1152547F3944C29CC593626683EBA5321F2F82788E5CABBC5DC7E9C0A5384

Function 01020388 Relevance: 1.6, Strings: 1, Instructions: 323COMMON

Download Yara Rule

Strings

e, xrefs: 0102065B

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID: e
API String ID: 0-4024072794
Opcode ID: d6f4bc9c800488cbd85202bb988dc456bdba9650cde5e2bc38da2dca10ce2ce2
Instruction ID: 689564cff75f6cde90a2fe6560a9bad7bbefda881e46dff28d2e91f86cd62a88
Opcode Fuzzy Hash: d6f4bc9c800488cbd85202bb988dc456bdba9650cde5e2bc38da2dca10ce2ce2
Instruction Fuzzy Hash: 7DB188B3F125254BF3544839CC683A266839BE5325F2F82788E5CAB7C9DD7E5C0A5284

Function 0106C0FF Relevance: 1.6, Strings: 1, Instructions: 321COMMON

Download Yara Rule

Strings

k, xrefs: 0106C23F

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID: k
API String ID: 0-140662621
Opcode ID: ff252d21fed1dbba99097a34c5164fad3d220e06cca37057ee5107a26b18a899
Instruction ID: 68c30a86f2cc9e07297b238342c4496b3e72afbebcf801dc010fd2a85b523c40
Opcode Fuzzy Hash: ff252d21fed1dbba99097a34c5164fad3d220e06cca37057ee5107a26b18a899
Instruction Fuzzy Hash: A7B17EF3F10A2547F3444969DDA83626683DBE4318F2F81788F59AB7C6E97E9C064384

Function 010C6703 Relevance: 1.6, Strings: 1, Instructions: 313COMMON

Download Yara Rule

Strings

, xrefs: 010C67C3

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 2492e5392f4acf9932010b47d5bdbff6294cf3e1f6cf7e9bbd5561b9f6d85231
Instruction ID: 40d516ad523ae274fdebf110ea326691fd02405327f3ffa580f8ab7751b8a071
Opcode Fuzzy Hash: 2492e5392f4acf9932010b47d5bdbff6294cf3e1f6cf7e9bbd5561b9f6d85231
Instruction Fuzzy Hash: 71B15AF7F1152547F3584878CD693A2618397A4325F2F827C8E8DABBC9D87E9C0A4384

Function 01082588 Relevance: 1.6, Strings: 1, Instructions: 307COMMON

Download Yara Rule

Strings

^, xrefs: 01082831

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID: ^
API String ID: 0-713906098
Opcode ID: aa3c41c96b873cbc36fc7b0dd060ceeab5f170c77f8e625b24611968f37d7c28
Instruction ID: 5ae202316883c4f6b9391f7b9d586046d7ca7c12a431cbd7fce90a34852c54cb
Opcode Fuzzy Hash: aa3c41c96b873cbc36fc7b0dd060ceeab5f170c77f8e625b24611968f37d7c28
Instruction Fuzzy Hash: 00A179B3F5162647F3544879CD593A265839BD1324F3F82388F5CAB7C5D87E9D0A1284

Function 0105945B Relevance: 1.6, Strings: 1, Instructions: 300COMMON

Download Yara Rule

Strings

JV~k, xrefs: 01059728

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID: JV~k
API String ID: 0-3590380015
Opcode ID: 463803b8a1568824c2dd9a75d1fa11525f6709f3bfb47e4328df42f1f9360c9c
Instruction ID: e3a681c2223ca827a82cb3062afb2832fabf0821f26aedf032d1de777949eae2
Opcode Fuzzy Hash: 463803b8a1568824c2dd9a75d1fa11525f6709f3bfb47e4328df42f1f9360c9c
Instruction Fuzzy Hash: 2FA1B8B3F1152547F3984C38CD683A26683ABD5321F2F82788E5D6BBC9DD7E5D0A5280

Function 00FB8330 Relevance: 1.5, Strings: 1, Instructions: 291COMMON

Download Yara Rule

Strings

., xrefs: 00FB8389

Memory Dump Source

Source File: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: 2eb3b11e0ae3b982ee5fb0e2656de59312c8924da63e9db3ebb7975e977c1140
Instruction ID: d7883e51c60c596e34e8b0e3d42f5ba16c7a56918b0f6d272d0188898dc63661
Opcode Fuzzy Hash: 2eb3b11e0ae3b982ee5fb0e2656de59312c8924da63e9db3ebb7975e977c1140
Instruction Fuzzy Hash: 6E912D71E042568BC721DE2AC8803DAB7E9ABC13A0F1C8A69D4D5D7395EA34DD42DFC1

Function 0104A086 Relevance: 1.5, Strings: 1, Instructions: 288COMMON

Download Yara Rule

Strings

ra=, xrefs: 0104A3E7

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID: ra=
API String ID: 0-1487186879
Opcode ID: 494691a7b8c6e172e505886b08a78dc53dfdc4dab30ef5512a7c9770030b76c7
Instruction ID: eea69755d1d1218266df8be6e8d6f2560c7dc3888cfa0d52cd0321fa87dd2ad0
Opcode Fuzzy Hash: 494691a7b8c6e172e505886b08a78dc53dfdc4dab30ef5512a7c9770030b76c7
Instruction Fuzzy Hash: F6A16AB3F1152047F3944979CC683A26283ABD5325F2F82788E5CAB7C9DC7E9D0A5384

Function 01045246 Relevance: 1.5, Strings: 1, Instructions: 281COMMON

Download Yara Rule

Strings

y, xrefs: 01045476

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID: y
API String ID: 0-4225443349
Opcode ID: 3242fd9ed86c5b3717564d3f3ba33e26bcdc67957a3b12fab93a3fa934bba53b
Instruction ID: 5fae1ff6c719d861df6e311bbc7eae1e4154e42bceda045b776067026d928257
Opcode Fuzzy Hash: 3242fd9ed86c5b3717564d3f3ba33e26bcdc67957a3b12fab93a3fa934bba53b
Instruction Fuzzy Hash: 66A147F3F115254BF3584939CC68362668397E0321F2F82788A9DAB7C9EC7E5C0A5384

Function 01090002 Relevance: 1.5, Strings: 1, Instructions: 249COMMON

Download Yara Rule

Strings

z, xrefs: 010900C8

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID: z
API String ID: 0-1657960367
Opcode ID: 2c6182473bbf72f8ef29d9dc17f548d4d140373276d5bd0dda4cc62bfd9f3bc3
Instruction ID: c27cfbc1a6693c6cf280b2f463aa7ec4dd36592b65931c0e061456b9ae77b256
Opcode Fuzzy Hash: 2c6182473bbf72f8ef29d9dc17f548d4d140373276d5bd0dda4cc62bfd9f3bc3
Instruction Fuzzy Hash: 5791DDB3F116254BF3544E28CC983A27693DB95311F2F82B88E4C6B7C9D93E6C099384

Function 010C824A Relevance: 1.5, Strings: 1, Instructions: 248COMMON

Download Yara Rule

Strings

t, xrefs: 010C8305

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID: t
API String ID: 0-2238339752
Opcode ID: 1b09261c324a867c2bb7227beb1a2df189aa220cf684c3c2ba84b9f6a250fe4b
Instruction ID: 8866f748935787c548d334c8d4e3e4dddd6e7ecca1e7f64e54c64800acb7861c
Opcode Fuzzy Hash: 1b09261c324a867c2bb7227beb1a2df189aa220cf684c3c2ba84b9f6a250fe4b
Instruction Fuzzy Hash: 6E817CB3F1153587F3500D28CCA83A26693ABA5321F2F82788E5C6B7C5D97E9D0A57C4

Function 010435AA Relevance: 1.5, Strings: 1, Instructions: 247COMMON

Download Yara Rule

Strings

}, xrefs: 0104367D

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID: }
API String ID: 0-4239843852
Opcode ID: 0023b419290f8382bf46b5d9a4b84cf47efb5f09ccbec7f1dc0b7226a94e03da
Instruction ID: 44c89c286e04c9a9cc874ffdb510c6ee0a889dc2d9c97a2189d06570891ca6ca
Opcode Fuzzy Hash: 0023b419290f8382bf46b5d9a4b84cf47efb5f09ccbec7f1dc0b7226a94e03da
Instruction Fuzzy Hash: C58187B3F1162547F3584D38CCA83A26283DB95315F2F817D8A4EAB7C6E87E5C0A5284

Function 010B118D Relevance: 1.5, Strings: 1, Instructions: 245COMMON

Download Yara Rule

Strings

J, xrefs: 010B1292

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID: J
API String ID: 0-1141589763
Opcode ID: ae161409d134f4a73f5f7ab113bc458763f9f92127229fd65a2a79bcdaffe561
Instruction ID: 16b7541e07154004008dfed64b74225bd88a00cde14b3004440945ce650bf26d
Opcode Fuzzy Hash: ae161409d134f4a73f5f7ab113bc458763f9f92127229fd65a2a79bcdaffe561
Instruction Fuzzy Hash: 69817BB3F616254BF3544D68CC483627293EBE5315F2F81788E88AB7CAD93D9C0A5384

Function 010601A2 Relevance: 1.5, Strings: 1, Instructions: 243COMMON

Download Yara Rule

Strings

>, xrefs: 01060311

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID: >
API String ID: 0-325317158
Opcode ID: a731ffc208fb87bb7ef35219bce03e0ccd20178f2f76d99993ff10f6e9e3be1a
Instruction ID: de54aef4d998078c74c7da556832e4fbc73ef42e8e1ca4f17a82c22814c6b654
Opcode Fuzzy Hash: a731ffc208fb87bb7ef35219bce03e0ccd20178f2f76d99993ff10f6e9e3be1a
Instruction Fuzzy Hash: AB8169B3F1062147F3544969DD983626583DBD5315F2F82788F48ABBCAD8BE9C0A53C4

Function 010B3068 Relevance: 1.5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

Strings

(, xrefs: 010B31ED

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID: (
API String ID: 0-2408637067
Opcode ID: 3b9b64de5ad8bbdc6e969b7cbde08ab6166cdb523e1e8854f8f196720ad1c0c6
Instruction ID: 1ab81ff5db355bec2ccac46147f3ce9d565681edb7bb5787c2d541d8d882f16c
Opcode Fuzzy Hash: 3b9b64de5ad8bbdc6e969b7cbde08ab6166cdb523e1e8854f8f196720ad1c0c6
Instruction Fuzzy Hash: A8818BB3F1291547F3440D28CC683A27283EBD5725F3F82788A696B3C5ED7E9D0A5284

Function 00FDB170 Relevance: 1.5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

Strings

", xrefs: 00FDB36E

Memory Dump Source

Source File: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 08379c2cfec4ee4560f7149afc2674de524dbb751cb7c6d8c58db735b762b861
Instruction ID: 33b9983492cd6b0fe1fbeb145379665fb00b26c258a23b7b4cb3e16f354cdd82
Opcode Fuzzy Hash: 08379c2cfec4ee4560f7149afc2674de524dbb751cb7c6d8c58db735b762b861
Instruction Fuzzy Hash: 6771B132A08315CBD714CE68C88032EB7E3ABC6760F2E856EE4949B395D3359D45A782

Function 0109E556 Relevance: 1.5, Strings: 1, Instructions: 233COMMON

Download Yara Rule

Strings

:f*\, xrefs: 0109E760

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID: :f*\
API String ID: 0-4282294716
Opcode ID: 15fe6d19bfdf6eb74192e8d1bea486041fb57bffff768d7f1f9e7ff99ea81c15
Instruction ID: cc754eab3febe640c2454dfb3dc1fb505f9fc1039913dfc66dec2ad0baccbce4
Opcode Fuzzy Hash: 15fe6d19bfdf6eb74192e8d1bea486041fb57bffff768d7f1f9e7ff99ea81c15
Instruction Fuzzy Hash: 4B819AB3F1162447F3544979CCA83622283DB95315F2F82788F8CABBCAD97E5D0A5384

Function 010144EC Relevance: 1.5, Strings: 1, Instructions: 233COMMON

Download Yara Rule

Strings

Fq\, xrefs: 01014668

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID: Fq\
API String ID: 0-4089488347
Opcode ID: 55e6f55719b885f2eadf635be0bdc221f3d952a2d9fc8498878b9f3de4397b9c
Instruction ID: c01e62a6534a850a6cfc43e3ed95439359b18770502cc55aea389731be1fea53
Opcode Fuzzy Hash: 55e6f55719b885f2eadf635be0bdc221f3d952a2d9fc8498878b9f3de4397b9c
Instruction Fuzzy Hash: AD8139F3F5152547F3544839CD69392658397E0325F2F82788F5DABBCAEC7E980A1284

Function 010272F5 Relevance: 1.5, Strings: 1, Instructions: 231COMMON

Download Yara Rule

Strings

@+mb, xrefs: 010274EB

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID: @+mb
API String ID: 0-4255595454
Opcode ID: 311a723f20d372b6e1e9d1679a7747c6d214a9ac74bb560d115c027e619b5d9c
Instruction ID: 20586747aea4cd4567e14e3aba398d16b42a27b6be3061cd35e0c87d9562b7da
Opcode Fuzzy Hash: 311a723f20d372b6e1e9d1679a7747c6d214a9ac74bb560d115c027e619b5d9c
Instruction Fuzzy Hash: 74819DB3F112254BF3804E78CC983627693EBD5311F2F82788A585B7C9D97E9D098784

Function 0102E2F4 Relevance: 1.5, Strings: 1, Instructions: 227COMMON

Download Yara Rule

Strings

KD+9, xrefs: 0102E43E

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID: KD+9
API String ID: 0-867651677
Opcode ID: ca1e03117337de92065c4049910a90a2c14f45873c929b85e608d67a122b1a84
Instruction ID: 8d2d3f837c8f3720fc7c3c489bce80bcbb6cb21ec1124e95433ed075c7374361
Opcode Fuzzy Hash: ca1e03117337de92065c4049910a90a2c14f45873c929b85e608d67a122b1a84
Instruction Fuzzy Hash: B4818CF3F1162447F3544979CD58362A683DBA1321F2F82788F5CAB7C9D97E9C0A4288

Function 010155E0 Relevance: 1.5, Strings: 1, Instructions: 220COMMON

Download Yara Rule

Strings

l, xrefs: 0101571D

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID: l
API String ID: 0-2517025534
Opcode ID: 938d6c4a38c8f1a6eba1fc9465bda7157c0f11dd515601385f2e27ef2d1273f7
Instruction ID: edceb13a0817a23ba29158c375af3ab4b2d6151fda8bbcbbf63d8c69f51b44b7
Opcode Fuzzy Hash: 938d6c4a38c8f1a6eba1fc9465bda7157c0f11dd515601385f2e27ef2d1273f7
Instruction Fuzzy Hash: 2971C1B3F116258BF3404E68CC983627653EBD5311F2F81788A482B7C9DE7E6C0A9784

Function 010555F6 Relevance: 1.5, Strings: 1, Instructions: 217COMMON

Download Yara Rule

Strings

%, xrefs: 010556F9

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID: %
API String ID: 0-2567322570
Opcode ID: 169a59812f2987d7dcc686d00dcd1db42b2c80fee66d777133f68ea66dfb7a8e
Instruction ID: 5ee1a0a996ea788a3ee0603f44c90415a07e7485a824e009594fc0ecb17b4cd7
Opcode Fuzzy Hash: 169a59812f2987d7dcc686d00dcd1db42b2c80fee66d777133f68ea66dfb7a8e
Instruction Fuzzy Hash: 9B71BEB3E112258BF3548D29CC583627693EBA4321F2F82788F9C6B7C5E93E5D065784

Function 010A410C Relevance: 1.4, Strings: 1, Instructions: 175COMMON

Download Yara Rule

Strings

f2s, xrefs: 010A410C

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID: f2s
API String ID: 0-1132053011
Opcode ID: dff30a87151e90df8b5ab037ae9ad8748b397effeef05f224c0aae1fe1eed113
Instruction ID: 5ed855177f47a8d17a250a2ba88e4d6db35227823fc830bc3cbe1a4c342bf7a7
Opcode Fuzzy Hash: dff30a87151e90df8b5ab037ae9ad8748b397effeef05f224c0aae1fe1eed113
Instruction Fuzzy Hash: 2B51AAB3F116254BF3540978CC983627692DBA5321F2F42788E9CAB7C9DC7E5D095384

Function 00FB74F0 Relevance: .6, Instructions: 611COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83213a2729f592a7edcd98fc7886bfd8d55118cdf426f5e19ae94b324be42bba
Instruction ID: 2b2db974e8776f9e37ee2b0a8369649a27c08fee13595152c50c9762d5e973d5
Opcode Fuzzy Hash: 83213a2729f592a7edcd98fc7886bfd8d55118cdf426f5e19ae94b324be42bba
Instruction Fuzzy Hash: 5E12B132A0C7118BC725EF19D8806EBB3E6FFC4315F29892DD98697285D734E851DB82

Function 00FC148F Relevance: .6, Instructions: 607COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed03ceb72e714528a2d8651ae6ae808d88d0ffaf948eb0e0b38c56199efca57e
Instruction ID: 22ecb9273d57f0561fbcb63150ca0dbf6157a72c3aa9462ba474ada244e06bc1
Opcode Fuzzy Hash: ed03ceb72e714528a2d8651ae6ae808d88d0ffaf948eb0e0b38c56199efca57e
Instruction Fuzzy Hash: 0F32EB76A04B418FD714DF38C9967A6BBE1BF86350F188A2DD4EB87382D634E415DB02

Function 0105814B Relevance: .6, Instructions: 601COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74681773f9230595da6883459d53540247de1f31c4ecc96f42fd1fa9e99ed886
Instruction ID: 8f39f08912517444d616e784adb9470603dad03a5125053c3b37f9bf17a612c2
Opcode Fuzzy Hash: 74681773f9230595da6883459d53540247de1f31c4ecc96f42fd1fa9e99ed886
Instruction Fuzzy Hash: 7F12AFF3F51A150BF3910879CD983A2198397E5324F2F82758FAC5B7D6D8BE8D4A4284

Function 010CD73D Relevance: .6, Instructions: 558COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3d5c8fae47109c4019c969eba8938ece11bfff0bd9389c162b1a25c01b4351b
Instruction ID: 2bc394467af3a38891743e0240df6d2082704db7e785204999163662ecb4a49c
Opcode Fuzzy Hash: a3d5c8fae47109c4019c969eba8938ece11bfff0bd9389c162b1a25c01b4351b
Instruction Fuzzy Hash: 6E12CDB3E046204BF3544978DD99366BA92EB94320F2B823D9F98AB7C5DD7E4C094385

Function 00FD91DD Relevance: .5, Instructions: 549COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89cee9101fa84045b4c3edba0d3b9afeb934d0f261ae637c6a7988a9b7805c37
Instruction ID: 0e093ce4b3654a095c7ed8abefa5645d6f0405283866038bd88706f631136e7f
Opcode Fuzzy Hash: 89cee9101fa84045b4c3edba0d3b9afeb934d0f261ae637c6a7988a9b7805c37
Instruction Fuzzy Hash: AEF127B2E043258BCF24CF98C8516AAB7B2FF85324F1D8159D896AF355E7749C42CB90

Function 0109744F Relevance: .5, Instructions: 539COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cabaf1488176e753eb7aaa57ecfbeecf27b319576ac66264fd5996eb0e68390c
Instruction ID: ba98ebe40786abe8123410b384c1d4e8b9df9477f6de14fb0be34f1ab1d16668
Opcode Fuzzy Hash: cabaf1488176e753eb7aaa57ecfbeecf27b319576ac66264fd5996eb0e68390c
Instruction Fuzzy Hash: 1502D1B3F105248BF3544D29DC983A67692EBD4320F2F423C8E98AB7C5D97E9D099784

Function 01042141 Relevance: .5, Instructions: 534COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f3af17d757c85936836139f879891c538f979a5c6807c9152a926019b9e3c11
Instruction ID: 9adb78d308eaa29a9b6c658b48fabff8235717baa6e3876e3064fde255d09b88
Opcode Fuzzy Hash: 2f3af17d757c85936836139f879891c538f979a5c6807c9152a926019b9e3c11
Instruction Fuzzy Hash: 4802AFF3F506250BF79508ACEDD83A1598297A5320F1F42B49F9CAB3C2D8AE5D4883C4

Function 010C5310 Relevance: .5, Instructions: 523COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4921ad43b55ca7146be6c33ff16a454b74acc06060d48a2f68e7664ea1f54275
Instruction ID: d71924ed52ee796abb8f2e10bace5669d6d7c85b2f8e7a5cc306df4412463d19
Opcode Fuzzy Hash: 4921ad43b55ca7146be6c33ff16a454b74acc06060d48a2f68e7664ea1f54275
Instruction Fuzzy Hash: 7302CDF3E056244BF3444E29DD98326B692EBD4320F2F863D9A98977C4E97E9C058784

Function 010BC032 Relevance: .5, Instructions: 514COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 344d8d14636989993159479f1bd3f57be6289c7a3440d20ac311e65c1b54c099
Instruction ID: a697fb15a3ecd5661c8f3435fc5924d5830d49bd8ea53f25127c357bc785a87c
Opcode Fuzzy Hash: 344d8d14636989993159479f1bd3f57be6289c7a3440d20ac311e65c1b54c099
Instruction Fuzzy Hash: 320282B3F1092507F7A9087CCDA93B5598287A5320F1F42B98F9E7B7C2D8AE4D4952C4

Function 010B01B5 Relevance: .5, Instructions: 507COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e233a19fe7ced9a1b9d3c975b6b4c19ffdd90bfdd01276ae65c0d5fc8de68a16
Instruction ID: fc5b51aa6c0678ae4708f62cfb495a6beba686d5fb89d693b240e7680626a5b1
Opcode Fuzzy Hash: e233a19fe7ced9a1b9d3c975b6b4c19ffdd90bfdd01276ae65c0d5fc8de68a16
Instruction Fuzzy Hash: E502BBB3F146204BF3445E29DD98366B692EBD5324F2B823CCB985B7C4D97E5C0A8385

Function 010A82B4 Relevance: .5, Instructions: 484COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3332e95418e076d70834ff5aea757723637ecf9f4db722ba49ed7a227d316187
Instruction ID: 6587dc072b6989067f86b3b228e99ae1279e55cb2b700c7bd79a86623ae2dcf9
Opcode Fuzzy Hash: 3332e95418e076d70834ff5aea757723637ecf9f4db722ba49ed7a227d316187
Instruction Fuzzy Hash: E6F1BEF3F006144BF3485929DC59366B693EBD4320F2F823C8A99977C9E97E9C0A4385

Function 0101B083 Relevance: .5, Instructions: 478COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33262655713e126d2b8289be5306de6f2b838f6d9d153c8fb9df743bdd033c43
Instruction ID: f85b9b71d0ca1a30fd9a9508ddc6651129e53ef0e9992a180a92b0326de33661
Opcode Fuzzy Hash: 33262655713e126d2b8289be5306de6f2b838f6d9d153c8fb9df743bdd033c43
Instruction Fuzzy Hash: 67F1E1B3E106214BF3544D78DD98362BA92EB94320F2F823D9E89A77C5D97E9D0943C4

Function 0106B03E Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f743541aafde5abaf92f73dbcd7d72567a4dddcefa1f7d1aeb126d65f3c47c0a
Instruction ID: bc68f71d211a6bf26f1e40b98eebb099a840b0e4c87537bf109ec4f651358115
Opcode Fuzzy Hash: f743541aafde5abaf92f73dbcd7d72567a4dddcefa1f7d1aeb126d65f3c47c0a
Instruction Fuzzy Hash: D1E1EEB3E142214BF3584D78DDA83A6B692DB94320F2F423D8E99A77C1D97E9C0543C4

Function 00FC5220 Relevance: .4, Instructions: 436COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e754941286e9004e17ab92275dc2c51529852b6e5b71060432613f650e246f60
Instruction ID: fec51a6428666588efaf491df12c1c870fd6b4dc36b3928252ccf7b22195bfd1
Opcode Fuzzy Hash: e754941286e9004e17ab92275dc2c51529852b6e5b71060432613f650e246f60
Instruction Fuzzy Hash: CBD12771508341DBD3249F14DC52BABB7A5FF96764F084A2DE4C98B3A1EB34A880E743

Function 00FD31C2 Relevance: .4, Instructions: 432COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dfce50d3bb30c67314b8d3a4f4c331c8b57abd3d4f6c2acf657171e363166fa
Instruction ID: 340c1845a10bd3d6318479680505d9192ad9a9e14e7f1e2929c60dc16a3710fd
Opcode Fuzzy Hash: 7dfce50d3bb30c67314b8d3a4f4c331c8b57abd3d4f6c2acf657171e363166fa
Instruction Fuzzy Hash: 11D1BE76A05116CFDB18CF68DC50ABA73B6FF89310F1A85A9D941E7390DB34AC11DB90

Function 00FD66D0 Relevance: .4, Instructions: 412COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: ff2df8f8b54731acf651aa8808487d6ef02d65c1a5f09fb308ec0f07f2eda091
Instruction ID: 3573909601002620df9116677b178202a07ddf2e43d2a9e67ffa1e6e3b10d12e
Opcode Fuzzy Hash: ff2df8f8b54731acf651aa8808487d6ef02d65c1a5f09fb308ec0f07f2eda091
Instruction Fuzzy Hash: CEB12771A082454BEB18CE24C8527AB77A3EF85354F1D853EE885DB382D639DC09E792

Function 00FC6263 Relevance: .4, Instructions: 405COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: d4160b1725921133e284a3091ff26aa87596b03ec5125b5978dfead40b5dcf57
Instruction ID: d14905e816bcbcf92f545d5663f07d59ed42dd83718d4a8d4abb745822e7c1a2
Opcode Fuzzy Hash: d4160b1725921133e284a3091ff26aa87596b03ec5125b5978dfead40b5dcf57
Instruction Fuzzy Hash: 92C13A72A0C3429FD714CF28C842BAFB7E2ABD5310F18892DE0C5D7292DB749845EB52

Function 010BC115 Relevance: .4, Instructions: 385COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 920f22822d14e9aa9922dee3d35877cd477cfe30f898bbefc518611e12ff13f3
Instruction ID: 8fbf55360a1efd267131f57c8d2eb6ca510eb5dc776efeec8a7aa8f1f83ea5ed
Opcode Fuzzy Hash: 920f22822d14e9aa9922dee3d35877cd477cfe30f898bbefc518611e12ff13f3
Instruction Fuzzy Hash: A4C155B3F2056407FBA9047CCDA93F519828755320F0F42BE8F9A6B7C2D8AE0D4952D4

Function 0107237E Relevance: .4, Instructions: 376COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fa5c87ac444da4af79719cb5c586395016b3e92109fc02a451cf7e92269a700
Instruction ID: 7c122a04f4005ae0cce41549fd1d6d182e006fe2f7231322c2bda9f3cf67c38b
Opcode Fuzzy Hash: 3fa5c87ac444da4af79719cb5c586395016b3e92109fc02a451cf7e92269a700
Instruction Fuzzy Hash: F8D167B3F116204BF3544979CD5836266839BD5325F2F82788E9CAB7C9EDBE5C0A4384

Function 010405A8 Relevance: .4, Instructions: 366COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4834035a13ef1c237a23c8c98e43d527327b53bf6e7e9017a779d21121d4de04
Instruction ID: b75dca6e6417a7ec5ae9d545c77d489ef6f879c31f536155832c802fd7485302
Opcode Fuzzy Hash: 4834035a13ef1c237a23c8c98e43d527327b53bf6e7e9017a779d21121d4de04
Instruction Fuzzy Hash: 85D1BEB3F116254BF3444D68CCA83627682DB95321F2F82788E5CAB7C9D87E9C0A5784

Function 0104E018 Relevance: .4, Instructions: 359COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d38375e10504812f8beb05a0daefa9034d1ceba27da688e54159874a8b11cf2e
Instruction ID: 5d2eda526414c8e3da0dbdd832c928426eb2955007181412d9ea2fa42ef02201
Opcode Fuzzy Hash: d38375e10504812f8beb05a0daefa9034d1ceba27da688e54159874a8b11cf2e
Instruction Fuzzy Hash: 44C178B3F115254BF3904879CD583A266839B91324F2F82788E5CBBBC6D97E9D0A53C4

Function 010BA477 Relevance: .4, Instructions: 358COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2ca81d57841fcb3fb75692f88a1354968edd34771ca496336193d280131bd0c
Instruction ID: f9cf247de67ef284ae14519dcfc1456fd35afd3f531ec5f179bd3c36bd05106e
Opcode Fuzzy Hash: f2ca81d57841fcb3fb75692f88a1354968edd34771ca496336193d280131bd0c
Instruction Fuzzy Hash: 30C1F5B3F142108BF3144E29DC65376B6D2EB94720F2B863CDA99A73C4E97E9C054385

Function 00FEF330 Relevance: .3, Instructions: 349COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 25c78391993e42a9d4815277ff963f5be90356254ed88e75c1b2c47b27d9b2cc
Instruction ID: 9bdcf98718b9551eb42a795d8b29e4069067620e6d8fb7158abc661b500bbe00
Opcode Fuzzy Hash: 25c78391993e42a9d4815277ff963f5be90356254ed88e75c1b2c47b27d9b2cc
Instruction Fuzzy Hash: A9B10436A183928BC724CF29C88056BB7E2BFD9710F19853CE98697365E731DC45E781

Function 010A137B Relevance: .3, Instructions: 348COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a136b5bc51158edd19ead88724cc454874545a886043e98298b7a345ff836c5
Instruction ID: 3da12ffde84ec91df61311821101e6f0cf09f84281fe18718d96cc315b4662cf
Opcode Fuzzy Hash: 5a136b5bc51158edd19ead88724cc454874545a886043e98298b7a345ff836c5
Instruction Fuzzy Hash: 83C15BB3F5162547F3544878CD983A26683DB94325F2F82788F8CA7BC9D87E9D0A52C4

Function 00FD52DD Relevance: .3, Instructions: 346COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fff8a9c1aec62b14fd852c259ab73b24b96a14fa710ed964972a14e4f51cfc54
Instruction ID: f6911e84b961ea1df3e394c0f03c83b781332cf4714c65451f367e714228f369
Opcode Fuzzy Hash: fff8a9c1aec62b14fd852c259ab73b24b96a14fa710ed964972a14e4f51cfc54
Instruction Fuzzy Hash: 84B1F576E00215CBDB18CFA9C8916BEB7B3FF89310F58816DD446AB355DB356842DB80

Function 0101C55A Relevance: .3, Instructions: 343COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1adca5e965bec2ee03f420b8a45b1c7fb3e4c05f46702d52c618dd7b8d21703
Instruction ID: b4e8e354525d7c0468668c6893761f90a5185bb5e07436cb067ab43c46341d6c
Opcode Fuzzy Hash: b1adca5e965bec2ee03f420b8a45b1c7fb3e4c05f46702d52c618dd7b8d21703
Instruction Fuzzy Hash: 7DC199B3E1062547F3644D68CD983A26683EB94325F2F82788F8C6B7C9D97E5D0A53C4

Function 010D1582 Relevance: .3, Instructions: 339COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff86fb9c5cb936a4eadbca6a238e6af51f86e9ead7ba7010eaea255746f26b83
Instruction ID: 197dffcbd2097032b0b5b3c2d51fb81c3bfe840d6c06b86f6233446c79840585
Opcode Fuzzy Hash: ff86fb9c5cb936a4eadbca6a238e6af51f86e9ead7ba7010eaea255746f26b83
Instruction Fuzzy Hash: D3C16BB3F2162147F3544969DC983A26683D7D4325F2F82788E986B7CADDBE9C064384

Function 010843DB Relevance: .3, Instructions: 338COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e6492d1a205836cd4dcb8c3a9531e1f31f1170a95e278eb5193afd4697c85bf
Instruction ID: 48a66b5ade8c8bf0e360e3c9f3c19352462e65e6b3b3a05e286ddb8d3261a50f
Opcode Fuzzy Hash: 0e6492d1a205836cd4dcb8c3a9531e1f31f1170a95e278eb5193afd4697c85bf
Instruction Fuzzy Hash: F6C1B0F3F116214BF3544969CC983A265839BD5325F2F82788E5CAB7C6E97E9C0A43C4

Function 0109F4FE Relevance: .3, Instructions: 338COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24c852f0db0ed3cf0517e145c84e0e00bb505e13993a59a9e133a30e018f87ad
Instruction ID: ef28bf4963ccb10eb9fc3c71989bbcc8b49f16d9b7390d2e91fe321876a1d3c5
Opcode Fuzzy Hash: 24c852f0db0ed3cf0517e145c84e0e00bb505e13993a59a9e133a30e018f87ad
Instruction Fuzzy Hash: 44B19FB3F516210BF3444969CCA83A26583DBD5315F2F81788F49ABBC9DCBE9C4A5384

Function 010945C8 Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8a8e128d7fbd8081e88f1bf8f7953234c7f6e52c77803aad6bcc3502cb65270
Instruction ID: c7768c192edb188e8dd7d3d3ccf7de40b2e69b5212601d7fd4bb96ff85860958
Opcode Fuzzy Hash: b8a8e128d7fbd8081e88f1bf8f7953234c7f6e52c77803aad6bcc3502cb65270
Instruction Fuzzy Hash: D3B1D0B3F046208BF3544E29DC94366B6D2EBA4320F2F813CDA88A77C5E97E9D054685

Function 0107A15C Relevance: .3, Instructions: 335COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b1591149fc104cb5480431a592fcd2e8fbf182dd2f326dc00e1f99575b9243e
Instruction ID: 8aceecb1ad28758c3c57afb7a26756852cb22ce2da52d9ce5f7317f4e5293aeb
Opcode Fuzzy Hash: 7b1591149fc104cb5480431a592fcd2e8fbf182dd2f326dc00e1f99575b9243e
Instruction Fuzzy Hash: 13C18EB3F116254BF3544938CD583627693DBA1321F2F82788F58ABBC9D97E9C0A5384

Function 0102F4A3 Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0f2f23ed893f6233e7aea970c8721700151ad5cf59b8ab311637e0987291845
Instruction ID: 2f1ecc3802bc772f85dad8931d46a39802f3979160c8dc8b60fad39f6dd819f1
Opcode Fuzzy Hash: f0f2f23ed893f6233e7aea970c8721700151ad5cf59b8ab311637e0987291845
Instruction Fuzzy Hash: B8B18BB3F105244BF3184E68CCA83A276929B95325F2F427CCE5D6B7C5D97E5C099384

Function 010504C3 Relevance: .3, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48b7a162a8cec1fd91682ad063dbbe1a67e095da10bc7ecff4851f11a877ab40
Instruction ID: 2f0e088e705f9d90cf21cb2f19cc070ea705b41388926cf5005753d8fd2b9f2d
Opcode Fuzzy Hash: 48b7a162a8cec1fd91682ad063dbbe1a67e095da10bc7ecff4851f11a877ab40
Instruction Fuzzy Hash: 26B19FB3F1192547F3544929CCA83626683DBE5325F2F82788E5CAB7C6DC7E9C0A5384

Function 0101371D Relevance: .3, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1a5a1c17360e1f939987c965b1d2f2d5d98461da14ed12458f541e35646dc89
Instruction ID: 97dc0ac6d270ac25ac77b3a1513b7d2f3e7cedf617d9e278e7ed5c569f214312
Opcode Fuzzy Hash: a1a5a1c17360e1f939987c965b1d2f2d5d98461da14ed12458f541e35646dc89
Instruction Fuzzy Hash: B6B1ACB3F1052547F7584D38CDA93B66682EBA0311F2F427C8F5AAB7C9E87E5C095284

Function 01064258 Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bf0a6f8fc088c15e5e4aa046b8ab88991e4134b58f446055b8cae61b48d139a
Instruction ID: 9f64857f66d93871e5da53bdacf87568a83743badf836b52eab10c2f03882687
Opcode Fuzzy Hash: 0bf0a6f8fc088c15e5e4aa046b8ab88991e4134b58f446055b8cae61b48d139a
Instruction Fuzzy Hash: 08B17BB7F5152147F3584869CC983A26583ABE1325F2F82788E9CAB7C5DC7E9D0A4284

Function 010B4491 Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21dfa7bdb166407ea276bab4d0f80a7a83830119817b1df18dba4cf905c6512e
Instruction ID: 8a3596ec55f9fea598a60264fe3c64e6fae873331b9abcdccb57b01c43fc1cdc
Opcode Fuzzy Hash: 21dfa7bdb166407ea276bab4d0f80a7a83830119817b1df18dba4cf905c6512e
Instruction Fuzzy Hash: BCB18AF3F105214BF3544D68CC983A27682DBA4325F2F42788E5CAB7C5E97E9D095784

Function 0104D723 Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ad792ef2ce388ab45346b4a68886e10b0d4cbc868f4e36b10cbd6e7e8c17320
Instruction ID: c3958614df02379f11cedbc88a9de00976cda77c284444491d987670d7df10a2
Opcode Fuzzy Hash: 3ad792ef2ce388ab45346b4a68886e10b0d4cbc868f4e36b10cbd6e7e8c17320
Instruction Fuzzy Hash: ECB17FF3F1152547F3444968CDA83626683EBD0325F2F82388F996B7C6D97E5D0A5384

Function 00FD2190 Relevance: .3, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93171bdf542ce571c6e11319e739479abe5915d08204c59082b9265e589d98a0
Instruction ID: b1085784a4bfc1c3fdeba45cabf05634c4e3746f6a72c17f22df8853fb02bb1f
Opcode Fuzzy Hash: 93171bdf542ce571c6e11319e739479abe5915d08204c59082b9265e589d98a0
Instruction Fuzzy Hash: 159137B2A043018BD720DF24CC91B7BB3A6EFE1354F08482DE98697381E775E904D7A2

Function 010B913C Relevance: .3, Instructions: 329COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f77525b2ef1a60706aa97d3b16c9fccc9868fa7bc9411030291466c28f2fac0
Instruction ID: db6c662c5cd75918d41ef7eb68ad53396f6a81092ad54b7975690b4e678b9c52
Opcode Fuzzy Hash: 1f77525b2ef1a60706aa97d3b16c9fccc9868fa7bc9411030291466c28f2fac0
Instruction Fuzzy Hash: 87B16EB3F516204BF3544979CD98392668397D4324F2F82788E9CAB7C9DCBE9D0A5384

Function 01069231 Relevance: .3, Instructions: 318COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5335fe6eb787d401747b9e525af5ebd9a3de2764409034f728b7d4c078690ab
Instruction ID: 1f8665fbc8522dd2143b9c98859d6aec7a95ad60c872ceee324559bef7a9c7c1
Opcode Fuzzy Hash: a5335fe6eb787d401747b9e525af5ebd9a3de2764409034f728b7d4c078690ab
Instruction Fuzzy Hash: 06B169B3F1162547F3544968DDA83626683DBE1314F2F82788F4C6BBC9E87E5D0A4384

Function 01023375 Relevance: .3, Instructions: 317COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5b7afaf1b2d18a41d4a3632dcd3664722c19e0907575e4d94bb9c2c49924cb7
Instruction ID: 947986f252b74eaf376299cb0ef8db80058ff9cb0b145209224535ab3d6e64d4
Opcode Fuzzy Hash: f5b7afaf1b2d18a41d4a3632dcd3664722c19e0907575e4d94bb9c2c49924cb7
Instruction Fuzzy Hash: 0DB19CB3F115254BF3544D38CC583A26683EBD5321F2F82788E58AB7C9D97E6C0A5384

Function 010392C6 Relevance: .3, Instructions: 313COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b272a63d8222fe0fc67016b404273ddd1d1af3c1d2e6cdfbb11337435dedb96e
Instruction ID: 014381a2aafc51ce4007c70545ab71599689dd3047c15ba832752d081134f5f4
Opcode Fuzzy Hash: b272a63d8222fe0fc67016b404273ddd1d1af3c1d2e6cdfbb11337435dedb96e
Instruction Fuzzy Hash: 54B169B3F115254BF3588D39CC583626683ABD5324F2F827C8A4DAB7C9D87E9D0A5384

Function 0108F319 Relevance: .3, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fdaaa43013ca88dae38a9c4b928c0e627181ff4b7904e8dbf747e8c6415ee29
Instruction ID: ca5258e72c5d222373ef77310bb67b7bc0bb0430f8214c049af3901c3514f36e
Opcode Fuzzy Hash: 5fdaaa43013ca88dae38a9c4b928c0e627181ff4b7904e8dbf747e8c6415ee29
Instruction Fuzzy Hash: 95B1A8B3F1162147F39448A4CC993A26682AB90324F2F82788F8D6B7C5D97E9C0A53C4

Function 0107D53E Relevance: .3, Instructions: 308COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2b3ce18d0db8caeb5c27ea8f2737c4949063938fd49f112978777dd776b69ed
Instruction ID: d25a3c9aef5a8b9b29119943d6a99b6431f1f8f5bde450578fa940b65e5d2f18
Opcode Fuzzy Hash: c2b3ce18d0db8caeb5c27ea8f2737c4949063938fd49f112978777dd776b69ed
Instruction Fuzzy Hash: 10B15CF3E1162647F3544878DD983626683DB94315F2F82388F5CABBC9E97E9D0A4384

Function 010574B5 Relevance: .3, Instructions: 307COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c02f57fff624714270037ce782fe78487ec1984c8c936e56332edf6a33587757
Instruction ID: e9bf351320800d05164b698cf7f5d2b4c1ad8e02649b7e1d306c107919192e4f
Opcode Fuzzy Hash: c02f57fff624714270037ce782fe78487ec1984c8c936e56332edf6a33587757
Instruction Fuzzy Hash: 52B169B3E105258BF3544D29CC583A27683EB94321F2F82788E9C6B7C9D97E6C069784

Function 01083368 Relevance: .3, Instructions: 305COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd8956c1b29c9d8fd3ba3a4d871a165bbc5642382cb167b23e50f9b9e14f5d1f
Instruction ID: 604d43aa198638459efaa3f9d47dd6aa86b49354e396bd204e88b86413689476
Opcode Fuzzy Hash: fd8956c1b29c9d8fd3ba3a4d871a165bbc5642382cb167b23e50f9b9e14f5d1f
Instruction Fuzzy Hash: 5AA16DF3F1162547F3544878DC983A26583DBD0325F2F82788B99AB7C6DCBE9D0A4284

Function 00FB6280 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc4bfdbd75c94b69f0a0099a9aec3f3e1abf52cef7a5ad0f4f638173c0b64b08
Instruction ID: 88f5c3d180379b46591491951947b11ffe61b0cc2aa89e736594a65c23413cf1
Opcode Fuzzy Hash: bc4bfdbd75c94b69f0a0099a9aec3f3e1abf52cef7a5ad0f4f638173c0b64b08
Instruction Fuzzy Hash: 39C148B2A487418FC360CF29DC96BABB7E1BF85318F08492DD1D9C6242E778A155CF46

Function 0107F1AA Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 661f1d6788c915a4cef6c8f3ac6da9926b86de65f02352991941435015fcf4d0
Instruction ID: 83c1851f73129240a1d7a7c7344904d29261c98e4148c15665f1307655da3984
Opcode Fuzzy Hash: 661f1d6788c915a4cef6c8f3ac6da9926b86de65f02352991941435015fcf4d0
Instruction Fuzzy Hash: BEA17CB3F116264BF3844878CD983A2668397A5325F3F42788E5CAB7C5DC7E9D0A5384

Function 00FD830D Relevance: .3, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc32eed10c3bad0f1e355a53140d8ec236ba712b30e0b8b3722d87d07ca758a4
Instruction ID: ffca43c11677092f841512a09f23a65f60c1d18f485ed5e8bbe2a31bb828b26c
Opcode Fuzzy Hash: bc32eed10c3bad0f1e355a53140d8ec236ba712b30e0b8b3722d87d07ca758a4
Instruction Fuzzy Hash: 4C914C72A5470A4BC714DE6CDC9066DB6D3ABC4250F4D423CD8958B386EF74AD0AD7C1

Function 01068049 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75a2f1672f70cba5ec11e1990264ec8b58aecb1a4bb9eab9f4a2eaadf9aff5ef
Instruction ID: 45238d7347b8e7b1154441946af6ce61c1e4dd7814d23e94374d0368adc9c940
Opcode Fuzzy Hash: 75a2f1672f70cba5ec11e1990264ec8b58aecb1a4bb9eab9f4a2eaadf9aff5ef
Instruction Fuzzy Hash: CDA159B3F1162547F3844969CD983626683E7D1325F2F82788F586BBC9DC7E9C0A5384

Function 0103B358 Relevance: .3, Instructions: 299COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 724d6ea551030ec26580f39aecbeb9c50e3bc6a6a24b194ce3832369b92f5d64
Instruction ID: c86d88a1e024dd3e5fe5b044fa09d02c70e9506afc2076c400ace4395ddecde7
Opcode Fuzzy Hash: 724d6ea551030ec26580f39aecbeb9c50e3bc6a6a24b194ce3832369b92f5d64
Instruction Fuzzy Hash: 60A19CB3F119254BF3544969CCA83A27683DBD5321F2F82788E9C6B7C5D93E9C0A5384

Function 0103759F Relevance: .3, Instructions: 297COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46e2d1173ae753ad3ba5e2adb37987f0dd99bc522fd85d673332c62baf575bbc
Instruction ID: ecdf75bc97e0e291107468255332d6d69e7efe17b4abda9e5663ac01b8b19cc5
Opcode Fuzzy Hash: 46e2d1173ae753ad3ba5e2adb37987f0dd99bc522fd85d673332c62baf575bbc
Instruction Fuzzy Hash: A9A18BB3F1162547F3844D28CC983A27683EB94311F2F82788E8D6B7C9D97EAD495784

Function 0103E2F0 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 377ba4a5a3e13c85f5fc9460a1bf3c46991f72c753dcb2d4362a82dc58233cf6
Instruction ID: a61fbbc2f2a52aa293669b87d2aa7ef910e3cae91d9eafb6ac74cf5199e93eb9
Opcode Fuzzy Hash: 377ba4a5a3e13c85f5fc9460a1bf3c46991f72c753dcb2d4362a82dc58233cf6
Instruction Fuzzy Hash: 50A127F3F21A2547F3984969DC98362618297A4325F2F82388E5DA73C6EC7E5C0A53C4

Function 010CF462 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b69987ad0de9e03fa5ed103b192c74c05e3d89f8771e3fa5a299d465de1d90f5
Instruction ID: 1e33aa0287e3df33bd34b1262d2e18fb3da9d695ffae63a4534eaaf10974f3e3
Opcode Fuzzy Hash: b69987ad0de9e03fa5ed103b192c74c05e3d89f8771e3fa5a299d465de1d90f5
Instruction Fuzzy Hash: B0A18EB3F115214BF3548D29CC583626283E7D5321F2F82788E58ABBC9DD7E9D0A5784

Function 010C95FD Relevance: .3, Instructions: 293COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc18b2234b5cdcba7b2558d102b4364c4d794d0717362c76850efc7578e3d89f
Instruction ID: b5dd433d53b2b167094b2b5cd065b55b9734936ff8740a8093865f94e757462e
Opcode Fuzzy Hash: dc18b2234b5cdcba7b2558d102b4364c4d794d0717362c76850efc7578e3d89f
Instruction Fuzzy Hash: ABA188B3F2162547F3844968CC983A26643DB94315F2F82788E8C6B7C9DD7E9D095384

Function 010B3403 Relevance: .3, Instructions: 290COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d279e905aa94191b0fe03ce8b86f908d6f4edc40f9ba7a2551d57d90d9629d30
Instruction ID: 04dc8cfc8202b3571c5e166f59e81f7f195ac3adbc8a095de80254bb986a7a07
Opcode Fuzzy Hash: d279e905aa94191b0fe03ce8b86f908d6f4edc40f9ba7a2551d57d90d9629d30
Instruction Fuzzy Hash: BCA19DF3F1162547F3904869DC983A265839BA1325F2F82788E5CAB7C5EC7E9D0A53C4

Function 0102B4AE Relevance: .3, Instructions: 288COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8999c1fd9a3599bbd7ac4476e418273e2d7c186c35e5b8932f558786cccfbce
Instruction ID: a5f5ae5fa22c193ef55946e428b417e1cf2c310b8ec8c83a23967fd8d9257044
Opcode Fuzzy Hash: f8999c1fd9a3599bbd7ac4476e418273e2d7c186c35e5b8932f558786cccfbce
Instruction Fuzzy Hash: 15A1CEB3F116254BF3444D68CCA83627693EB95311F2F8278CE58ABBC9D97E5C0A4784

Function 01088239 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b396427c85d537d6f473d4e53db8ec3a58989c305ec04cbe4070f62d51ddd7b
Instruction ID: 3b34b5a997eb81f7c0340fbe8757ec05a38dee37cfabdc768d8c3eafed7e5bd4
Opcode Fuzzy Hash: 0b396427c85d537d6f473d4e53db8ec3a58989c305ec04cbe4070f62d51ddd7b
Instruction Fuzzy Hash: BEA18AB3F519244BF3448969CCA8362328397E5315F3F827C8A595B7CADC7E5C0A5384

Function 0103C5AB Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 830a86a75aed1ef6c2c175c9cf49a35d2c690255f271c88edd0afd98b4ed0de1
Instruction ID: acd3136458ddfa94f554d614627a9faec5f6154cdb4ec9a01bede1960f1129a7
Opcode Fuzzy Hash: 830a86a75aed1ef6c2c175c9cf49a35d2c690255f271c88edd0afd98b4ed0de1
Instruction Fuzzy Hash: 7EA1ADF7E61A3547F3544878DC9836266829B95325F2F82788F6CAB7C6D87E5C0903C4

Function 0104F18E Relevance: .3, Instructions: 286COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe428d57eb0d35b9e3a48ec91308daa40cb6a388db37815501141d4a9862e9d3
Instruction ID: 182f895914f78e3811dd26503a823c810c8324109038ff4ba47209a237bd8889
Opcode Fuzzy Hash: fe428d57eb0d35b9e3a48ec91308daa40cb6a388db37815501141d4a9862e9d3
Instruction Fuzzy Hash: 99A16AF3F115254BF3844978CC583A266839B95325F2F82788B586B7C9ED3E9D0A5384

Function 0106E060 Relevance: .3, Instructions: 286COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f16b04f87222f5dd70c9ae0b9404909d293048d1b9615604a4c80ed03b56b114
Instruction ID: 6d7d4bcdf41f3f165f3bafa87d34c8ef6d5b55a35c68a36fa057c38e42921e47
Opcode Fuzzy Hash: f16b04f87222f5dd70c9ae0b9404909d293048d1b9615604a4c80ed03b56b114
Instruction Fuzzy Hash: EEA18BF3E106354BF3548D78CC983626692AB95324F2F82788E9C6B7C5E93E5D0993C4

Function 01048004 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1a6e1f2967c807ecbfaddb8645cc5689d1e2d64e5fe997079f3ab3706dca5d9
Instruction ID: 4765f1720e503cae1fc9ef206c8f58144545ba81c2d9101dc9ab89f8f456bf13
Opcode Fuzzy Hash: c1a6e1f2967c807ecbfaddb8645cc5689d1e2d64e5fe997079f3ab3706dca5d9
Instruction Fuzzy Hash: F6A16DB3F2152547F3944869DCA83626283ABE5325F3F82788E9C677C5DC3E9D0A5384

Function 0107058B Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afabdc578003e662ccad3776d98842712df74e1863a52968d6c5b2d64332a37f
Instruction ID: 01c71f581287364ba0109514e2fc141d4014081d6777323d77b9ba6df10031f4
Opcode Fuzzy Hash: afabdc578003e662ccad3776d98842712df74e1863a52968d6c5b2d64332a37f
Instruction Fuzzy Hash: 09A1BDB3F1152547F3544D28CC6836266839BD5325F2F82788E5C6B7C5D93EAC0A53C4

Function 01076712 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dea4b4a4eac1586eef4bae21adcedf62389c895148512d77b886b3a9989b7b62
Instruction ID: cb915b24570be019b19139d7304259eb76393747896fb5495799942def5d3eb3
Opcode Fuzzy Hash: dea4b4a4eac1586eef4bae21adcedf62389c895148512d77b886b3a9989b7b62
Instruction Fuzzy Hash: C9A1ADB3F115254BF3944968CC683627683DB95321F2F82788F59ABBC9ED3E9C095384

Function 0109A3BF Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52300e37dd844e707a8eb8528f31769bd2af939c9e8c479a88d8a9a97e4234ec
Instruction ID: 4f85986349bde5fdb80926772e45e8b5570d9677770ffe4f90e6c424afa377d9
Opcode Fuzzy Hash: 52300e37dd844e707a8eb8528f31769bd2af939c9e8c479a88d8a9a97e4234ec
Instruction Fuzzy Hash: 96A1A9B3F116244BF3544D78CCA83626683EB95321F2F86788E986B7CADC7E5C095384

Function 0106F742 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80b48677ebf4ea267ae61bd0ff9e919e39a435b698e955cd9a45b5ed6cf3dbbe
Instruction ID: 689fd7e5d7832fd475ee24fede647385d5630dd2171604495cb762bfea17ffa1
Opcode Fuzzy Hash: 80b48677ebf4ea267ae61bd0ff9e919e39a435b698e955cd9a45b5ed6cf3dbbe
Instruction Fuzzy Hash: 8691C1B3F5162507F3584879DCA83A266839BD5324F2F427C8E8D6BBC5D9BE4D0A5380

Function 010D0152 Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cef9ad5df4cc6d10e19bdb1b7eac0adb07d8eefd0bed8ae03d59e89907b1d481
Instruction ID: 18fb434f5c9cb45ac93883eca94dc0880f4b48c0556f6fe4663258464a65fbc1
Opcode Fuzzy Hash: cef9ad5df4cc6d10e19bdb1b7eac0adb07d8eefd0bed8ae03d59e89907b1d481
Instruction Fuzzy Hash: 9D919DA3F2162547F3484938CD683A26583D7D5325F2F82788F59AB7CADC7E9D0A4384

Function 010AE2D3 Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14e7906b0dcfdb77e6276d425bc3bc5bbf09bc733f7e73ea453975df967fb5d9
Instruction ID: 03d2de2eaa1600c022c5100bb5d650b67f71f77145658dd95bc30ffc103d159a
Opcode Fuzzy Hash: 14e7906b0dcfdb77e6276d425bc3bc5bbf09bc733f7e73ea453975df967fb5d9
Instruction Fuzzy Hash: 0CA166F3F116254BF3544829CC683A26683ABD1325F2F82788E4CAB7C5DC7E9D0A5384

Function 0103D429 Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 389db09496077aff1d0bed78f97fe9ad689df68591f2418777e94e441d991ea3
Instruction ID: 7acecaeb4888196f121e4911b7dd3d997fbaf72230ce4b91835599fe0a3877f7
Opcode Fuzzy Hash: 389db09496077aff1d0bed78f97fe9ad689df68591f2418777e94e441d991ea3
Instruction Fuzzy Hash: 74A1CFB3F116214BF3944878CD683622583DBD1325F2F82788E596BBC9DC7E9D0A5384

Function 0109809A Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b374d52aaec3849aae5b4fa7548180b99f3ff2b8a7db036d2d8245a20a42b6fb
Instruction ID: 91338c3b520aa629fc5dc28b3698f677467734fa045ab66012c1835afb3e14cf
Opcode Fuzzy Hash: b374d52aaec3849aae5b4fa7548180b99f3ff2b8a7db036d2d8245a20a42b6fb
Instruction Fuzzy Hash: 43A17AB3F016254BF3404E28CCA83627693EBD5325F2F82788A586B3D5D97E5D0A5784

Function 010794F8 Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70cadc56040c3d96bfb3c870118a5cd4af5ce1e19db4316b6e73b7225435ffdc
Instruction ID: 0e22a08a0b72acb146e18f790ea519704ecb42b77227500bf50e4109a7278873
Opcode Fuzzy Hash: 70cadc56040c3d96bfb3c870118a5cd4af5ce1e19db4316b6e73b7225435ffdc
Instruction Fuzzy Hash: 66A18EB3F5062447F3544D39CD983A266839BD4325F2F82788E5C6B7C9D8BE5D0A5384

Function 0108A342 Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 451acb4b24de3e66007a688391184767b3aa03c78e3df614c9ea9458ecee23d2
Instruction ID: daa307234868b44ae6146893dceb7fd53680ee0e4d0d4f2331d42d5350eae703
Opcode Fuzzy Hash: 451acb4b24de3e66007a688391184767b3aa03c78e3df614c9ea9458ecee23d2
Instruction Fuzzy Hash: 8D91CBB3E11A2547F3544D68CC983627683EBD4321F2F82788E586BBCAD97E5D0A53C4

Function 010CA36C Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa67a68024d5c3b7e91615997cbb7cd4eff6012eb80b417a70f196ab83d21b82
Instruction ID: 0b0a6291db0c1da3bb3d71705090d7fd732bcdcfa4f1899e5a12ba0c4e87bdf9
Opcode Fuzzy Hash: aa67a68024d5c3b7e91615997cbb7cd4eff6012eb80b417a70f196ab83d21b82
Instruction Fuzzy Hash: 45A18DF3E1062547F3984868DCA93626682D794324F2F427D8F9EAB3C6DC7E9D094384

Function 0105A5AE Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9cf9b53a44c1684f8606796cfd95955cb1e24311ec99c7861844560690fc882
Instruction ID: b7952a9b97e04a79e81b5dc4f762de23ff85258d6096dcc569766145ce020d31
Opcode Fuzzy Hash: c9cf9b53a44c1684f8606796cfd95955cb1e24311ec99c7861844560690fc882
Instruction Fuzzy Hash: C6A1ABB3F10A254BF3544D79CC983627292DBA4311F2F82788E5CAB7C6D97EAD095384

Function 0102137B Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87627dcdf0afdef14aaa20e8da7a87aa7d39f25294988febfb288deba56ac611
Instruction ID: 7d596ed115d5ee46212413927d75c9ab0f57b5b93aff65b0bdc829ab26aca5fa
Opcode Fuzzy Hash: 87627dcdf0afdef14aaa20e8da7a87aa7d39f25294988febfb288deba56ac611
Instruction Fuzzy Hash: 98914CF3F1162547F3944929CC58362B68397D4325F2F82788E8CAB7C9DD7E9D0A5284

Function 0104429B Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4954c732c07bea827cac9fea7a3bf5d4f5f14b9d115ec8ad52bdc6fff22b099
Instruction ID: 9f868e4f70e00e9872a06e62adc516fd99beb419dd3f78f76956783ee5b8364a
Opcode Fuzzy Hash: d4954c732c07bea827cac9fea7a3bf5d4f5f14b9d115ec8ad52bdc6fff22b099
Instruction Fuzzy Hash: BD915BF3F216244BF3584838DC593A26583D7E4315F2F82788A99AB7CAD87E9C094384

Function 010AB749 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a604d72099f142c1ec35fc12e0f5124ab9339dc5d97be05d42161ffa360bef66
Instruction ID: 0b200765936b6b1eaaf1b840244a48f5e33ba946746b9f1cde7017a73229b341
Opcode Fuzzy Hash: a604d72099f142c1ec35fc12e0f5124ab9339dc5d97be05d42161ffa360bef66
Instruction Fuzzy Hash: E19159F3F5062147F3584878CDA93626582DB91314F2F82788F9DA7BC6EC7E9D0A5284

Function 0104D2B1 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be8c81c25c32fca62890fce08ecf9dca12875347b109f076c75db6bdeb89c1d9
Instruction ID: 3e114dc9a997f13cedf22c585c67cdd88e6c8af9a06f0a56aa37d2934f40a1b0
Opcode Fuzzy Hash: be8c81c25c32fca62890fce08ecf9dca12875347b109f076c75db6bdeb89c1d9
Instruction Fuzzy Hash: FB918EB3F516214BF3944879CD883A26583EB95321F2F82788E5CAB7C5DC7E9C0A5384

Function 0106854F Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b1d3726dade3c40c2b44d4ad2654a6050ccc80c187fb3aa843535b96ee1a475
Instruction ID: f8894318ab425f698d7e1d9b2c2d048d0e0e0a0ff3d9be2623c72c9dfe45a6ea
Opcode Fuzzy Hash: 6b1d3726dade3c40c2b44d4ad2654a6050ccc80c187fb3aa843535b96ee1a475
Instruction Fuzzy Hash: DB9167B3F116254BF3A04D69CC5836262839BE4321F2F82798E9C6B7C5D93E6C0A5784

Function 0108517C Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce9165cc100999f910814cf8f14c4bcd55b71ce69de761f9ad2430b50a981627
Instruction ID: 5b61715619f36ea8f74c644e2fba4a12113192f0b535a99cdd6d9a3d0d777523
Opcode Fuzzy Hash: ce9165cc100999f910814cf8f14c4bcd55b71ce69de761f9ad2430b50a981627
Instruction Fuzzy Hash: 4091ACB3F106214BF3404978CD583622A93DB95321F2F8278CE5C6B7C9D97EAD095384

Function 010C91B9 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a9f0051e8f07b224ae6fcde857908c461d6d83fa0fd11b89e0535938f09627a
Instruction ID: ff5795919e25ed5ca506f9345388f9f65e34e30123b741d7b7f020aa8abc4cdc
Opcode Fuzzy Hash: 5a9f0051e8f07b224ae6fcde857908c461d6d83fa0fd11b89e0535938f09627a
Instruction Fuzzy Hash: 3E91BFF3F1192447F3504969CC98362B693DBE5315F2F82788E586B7CAD97E5C0A4384

Function 010A9715 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bd79ff54059cd3d643f83fdc9e30373bcaeb39980496faa0df98516a182c351
Instruction ID: 8f829edbbd8baba20fa7eabf5e1b55d598072dab78f703353f5c475c7e094f16
Opcode Fuzzy Hash: 5bd79ff54059cd3d643f83fdc9e30373bcaeb39980496faa0df98516a182c351
Instruction Fuzzy Hash: 3D91ACB3F115214BF3544929CC983A27683EBD5324F2F82788E4C6B7C5D9BEAD0A5384

Function 010381F4 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bdc0cf7acdd6e03ffb6801dd4270a946ac1f3fe46b9ee4123d4d314262c45a8
Instruction ID: acae68dcb6135c1969dba4ef900caa0330dac15a5e424bf38fd064ac36a523c5
Opcode Fuzzy Hash: 2bdc0cf7acdd6e03ffb6801dd4270a946ac1f3fe46b9ee4123d4d314262c45a8
Instruction Fuzzy Hash: C8918FF3F11A2547F3484929CD683626683EBE0715F2F82788F496B7C9ED7E9C095284

Function 0108B34B Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 452b87554f0776bfee268387717bd7aacbeb427f81aea331492330d61c610523
Instruction ID: d12805a04316abc0ccc2a43c81b814cfbc7cd0b56f73dc272f393e89a7b0bb4a
Opcode Fuzzy Hash: 452b87554f0776bfee268387717bd7aacbeb427f81aea331492330d61c610523
Instruction Fuzzy Hash: 12917BB3F116244BF3944969CC983627683DBD5321F2F82788E98AB3C5ED7E5D0A5384

Function 010140D0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8f713324b25c1ac8c0ea59500b829272467aac136090cb5ec3b7bde891f42e6
Instruction ID: 94cbf5387e41e749c9cb3afc0c370dc6c33ba3d9d43cd6e81cc5ba1708c075e8
Opcode Fuzzy Hash: a8f713324b25c1ac8c0ea59500b829272467aac136090cb5ec3b7bde891f42e6
Instruction Fuzzy Hash: 6C917CB3E0162547F3A48D29CC9836676839BD4325F3F82788E9C6BBC9D93E5D064784

Function 01036426 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0dd5efc929734fc785c5a2a97a0030756d76eff31c61fc999f082e55530eedb
Instruction ID: d392a1493bbb155fd3ee390d392679b30c6ca845c948e84dea36c679b7602c91
Opcode Fuzzy Hash: b0dd5efc929734fc785c5a2a97a0030756d76eff31c61fc999f082e55530eedb
Instruction Fuzzy Hash: 71918CF3F1062547F3584D69CC983627283DBE5311F2F82788A589B7C9ED7E5D0A5284

Function 010AB31F Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f919db9cb54b8e01c52b392d7824564ae4224bc4a38d154fe8d3e783595a2f6
Instruction ID: e942fdf296171757e9698c11a6033e91a83d8b93136fd3202f8c6034cdbaff44
Opcode Fuzzy Hash: 5f919db9cb54b8e01c52b392d7824564ae4224bc4a38d154fe8d3e783595a2f6
Instruction Fuzzy Hash: 8B917AB3E1192547F3644D28CC983A27293DBD5321F2F82788E9C6B7C5D93EAD099784

Function 0109C30E Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 274f23196fdbfc5a19c4a6866c3ed6a79d4c137b611476b6c0c1926d1a24b56d
Instruction ID: 36dc6d81a56af6fcd5a34a154f3dbb028402fb721763bf1ce7735d101ba276c8
Opcode Fuzzy Hash: 274f23196fdbfc5a19c4a6866c3ed6a79d4c137b611476b6c0c1926d1a24b56d
Instruction Fuzzy Hash: A991E5B3F116254BF3544D28CCA43623683DBE6311F2F827C8A885B7C9D97E9C0A9784

Function 010AD297 Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b3561e719663a1a75105e5cc3e1c8a52de91109a568bb7966212c7484af9f46
Instruction ID: 60371228c02942b94c7b4c047e084fb344a216b3c6549e53b2585373ad02bf4e
Opcode Fuzzy Hash: 8b3561e719663a1a75105e5cc3e1c8a52de91109a568bb7966212c7484af9f46
Instruction Fuzzy Hash: 75919CF3F2162547F3544878CC983A26683DBD4315F2F81788B48ABBC9E97E9D0A5384

Function 010A43CC Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31ca4cb1712250764fee0c52dbfc5561b4bc06e890463a04c9dbe7288ed38386
Instruction ID: 4f11e60e9d0f083c092d1f32a774a6333d35d357d6595ad6b7caeeeaf620f830
Opcode Fuzzy Hash: 31ca4cb1712250764fee0c52dbfc5561b4bc06e890463a04c9dbe7288ed38386
Instruction Fuzzy Hash: 3191BFB3F016244BF3544D69CC683627683DBE9311F2F82788A5CAB7C9D9BE5C0A5384

Function 010CD2DF Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f5415ca21e424db9058170992ca86eadb04210be676a9e867645966d97ff03f
Instruction ID: 6f0060a0d419ba1d957b30f981ad4bb6b90aea0cb563724c1161a5ff65123a2d
Opcode Fuzzy Hash: 7f5415ca21e424db9058170992ca86eadb04210be676a9e867645966d97ff03f
Instruction Fuzzy Hash: 93918BB3F1062547F3544D24CC683626683EBA5321F2F82388F996B7C5ED7E5D0A5384

Function 01054009 Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be3a87fcf9c241e600afdf5758cd8913a1931523dcda69857148fe90587172fa
Instruction ID: 8e7f03fcea7d882d7cad539885ff354d852419968c71d91a59f667990d1db3af
Opcode Fuzzy Hash: be3a87fcf9c241e600afdf5758cd8913a1931523dcda69857148fe90587172fa
Instruction Fuzzy Hash: C5918CF3F1162547F3544869CC683626683DBE5315F2F82788E4CABBC9E87E9D0A5384

Function 010BD57A Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd5fa5ffe3ceab7aca95a9dd4eeb1f3e7e03c3a9a072084e63550db863ed7da7
Instruction ID: 5da9d3728e4ac9aff63e9f94d78cd0e33f17f8c5e05c65e9612560e0fbf9c9d0
Opcode Fuzzy Hash: dd5fa5ffe3ceab7aca95a9dd4eeb1f3e7e03c3a9a072084e63550db863ed7da7
Instruction Fuzzy Hash: 5C91A8B3E119204BF3544D69CC583A27293ABE5325F2F82788E8C6B7C5D93E6D0A57C4

Function 01011455 Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a79cd12f1c66bd33b117549284bc5775029ab5b40dbcc0b1cf24a9655926171
Instruction ID: 5de7a31d41e7dbfb251a0d5e99ce4f60728c422cd60ca7b1e1d92fece57552bf
Opcode Fuzzy Hash: 0a79cd12f1c66bd33b117549284bc5775029ab5b40dbcc0b1cf24a9655926171
Instruction Fuzzy Hash: 47917BF3F516264BF3544DB4CD983626683DBA0315F2F82388F48AB7C9D97E9D0A5284

Function 0103C1A2 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cf7a326f8e464400c3085223824da2c1dcd9b41e8bdd9e59d898e567bb27294
Instruction ID: 4935e09366538ef6808fd5938d9c04823e0f77094eec2967514b145b3d5f2dae
Opcode Fuzzy Hash: 2cf7a326f8e464400c3085223824da2c1dcd9b41e8bdd9e59d898e567bb27294
Instruction Fuzzy Hash: 6B917BB3F106254BF3948978CC983627682DBA5321F2F82788E5CAB7C9D97E5D095384

Function 01095188 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb217186f63bd36253f15a9156e39db1e3a95826e61c2d8526003da928f3633a
Instruction ID: 6489a9b776debc81e98b7f73dc1e31da8a719ec0077a8e10ddff6d2b4868ed37
Opcode Fuzzy Hash: fb217186f63bd36253f15a9156e39db1e3a95826e61c2d8526003da928f3633a
Instruction Fuzzy Hash: 4091BCB3F1193447F39409A8DC683627282AB95315F2F82B88E4DBB7D5D97E9C0A53C4

Function 0104A535 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae97c6a55790ea4d68f1e933069f1e5b4307f0d0d12f44a9d22f1ecd7841607a
Instruction ID: cd9bdf4a696a525da343da6dacd03a2f4a7093ae0da6538a62dc6a671598cd33
Opcode Fuzzy Hash: ae97c6a55790ea4d68f1e933069f1e5b4307f0d0d12f44a9d22f1ecd7841607a
Instruction Fuzzy Hash: 52918AF3F5162447F3504D69CC983526683A7A5325F2F82788E6CAB7CAD87E9C0A53C4

Function 010AA39B Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5d303d85cce76ed6630e301ac9078ddfc248809fb71968ac46fbf07c1fbca2a
Instruction ID: d5418eed54188add66e01cbac3770c47db4c2affed25921b282d7651a16fc761
Opcode Fuzzy Hash: a5d303d85cce76ed6630e301ac9078ddfc248809fb71968ac46fbf07c1fbca2a
Instruction Fuzzy Hash: C2916BB3E1162547F3544978CC583A26693DBE0325F2F82788E586B7C9ED7E9D0A4384

Function 010C15E7 Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4cb52699dc9b95a9a6b6721d8d791b4db5c37cd361dd487c74f42171c469101
Instruction ID: e094c06510d65045985b6d94854bfd931afc4d850b136ebb17d6a19f33b41a60
Opcode Fuzzy Hash: e4cb52699dc9b95a9a6b6721d8d791b4db5c37cd361dd487c74f42171c469101
Instruction Fuzzy Hash: B491B0F3F2162547F3844D68CC993A27282DBA5311F2F82788E589B7C5DD3E9D095784

Function 0100F5ED Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b66d2395cfbfce312954f642bf15b1cbfb7af313c89bbdcda6943aa438392d38
Instruction ID: f1d78885f9552e1ddbbb0d28ce0215cbb06e54d2d3792b32e74efd3f0bcf903a
Opcode Fuzzy Hash: b66d2395cfbfce312954f642bf15b1cbfb7af313c89bbdcda6943aa438392d38
Instruction Fuzzy Hash: 1A819BB3E115254BF3404D28CC583A27693ABD5325F2F82788A4C6B7C9DD7EAD0A9784

Function 0102D0A3 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1141555902b2b6d0bbc6bfc8dfb42209866d000b00b37e244b0606a47080b8fc
Instruction ID: e9b8a4b1c3528c698eeaa09341f9fd16270058f026c49bd473e9db5b669cf5fc
Opcode Fuzzy Hash: 1141555902b2b6d0bbc6bfc8dfb42209866d000b00b37e244b0606a47080b8fc
Instruction Fuzzy Hash: 5A814AF3F6152547F3544878CD983A265839BE4325F2F82788E6C6B7C9D87E8D0A5284

Function 010A65D0 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b921c5f54dac5cde1ab4100efc90458f4f336ad7d61614e8232b74bacdc6331
Instruction ID: 3afd312baa6d05e51a32f21c73812194a01a6587b66db6ccba8e1a1dcf095458
Opcode Fuzzy Hash: 9b921c5f54dac5cde1ab4100efc90458f4f336ad7d61614e8232b74bacdc6331
Instruction Fuzzy Hash: 56917AB3F105258BF3544E28CC583627693EB95321F2F817C8A896B7C4D93F6D199784

Function 0102632A Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4eb33c48b782fdb7530a1aaf5a7a2b06b5f435b47ace66dd870381863f17d07
Instruction ID: 0ec456c2b1bae17e39afdd21681d2defa4caba96a360d3ebbb0bbda709b083eb
Opcode Fuzzy Hash: a4eb33c48b782fdb7530a1aaf5a7a2b06b5f435b47ace66dd870381863f17d07
Instruction Fuzzy Hash: 1D817DF3E6162547F35408B8CD9836265839BA5321F2F82788F5CAB7C9E9BE5C0952C4

Function 01051735 Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53367238882ce0b6b9db4e1f49ee2d5c419857e8fe8df91e93776532723c0781
Instruction ID: 068f764cc68f936814ae7783ddd1e10d087ec51098728558e970f13a997f0d67
Opcode Fuzzy Hash: 53367238882ce0b6b9db4e1f49ee2d5c419857e8fe8df91e93776532723c0781
Instruction Fuzzy Hash: 07819AB3F1163447F3544D68DC983A276839BA5321F2F82B88E5C6B7C9E97E5C498384

Function 010BD1A1 Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da229a0ce1c52c68fb61e288eb6d5e47e044874d5921f45fe290add0ac79405c
Instruction ID: 83a14fd31d5f9902e0358ed39beed347fd2b3c3c22de7fa93f1ec644b567ed39
Opcode Fuzzy Hash: da229a0ce1c52c68fb61e288eb6d5e47e044874d5921f45fe290add0ac79405c
Instruction Fuzzy Hash: 0F817BB3F1162487F3544D69CC983A27283DBA5325F2F41788E9C6B3C6D97E9C0A5784

Function 0109347F Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87a31b6b6d2df0751801f13c3efd366bd018b75f683e9d2bc1be04ded5cc3816
Instruction ID: a193526f8443397b325b27685de6ef6d4a338cd5e9b2ace8556c699a182b5e55
Opcode Fuzzy Hash: 87a31b6b6d2df0751801f13c3efd366bd018b75f683e9d2bc1be04ded5cc3816
Instruction Fuzzy Hash: 1C81BCB3F115254BF3504E28CCA8362B293AB95324F3F82788E4C6BBC5D93E5D0A5784

Function 010D32C3 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ddc6cab8ff29cb9604b88fd071494b6196d954bcfa95a5c1ea7326d19a446e8
Instruction ID: f14289a950a1c85ae0691e01263e9ecdf7011ca877801dc1e941d052abbc8b7e
Opcode Fuzzy Hash: 8ddc6cab8ff29cb9604b88fd071494b6196d954bcfa95a5c1ea7326d19a446e8
Instruction Fuzzy Hash: 3C815AB7F116244BF3984878CCA83626683E794324F2F82398E596B7C6DC7E5D0A53C4

Function 010B61F1 Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14d13fad5c7816d76528d2dc42fe96ff97b044d0b49540126b1169527a0df917
Instruction ID: ae9ab44b51bbb1468012f6561c58a84d7ead559ed0f7141fa83fc5439530427b
Opcode Fuzzy Hash: 14d13fad5c7816d76528d2dc42fe96ff97b044d0b49540126b1169527a0df917
Instruction Fuzzy Hash: 20818FB3E1162547F3504968DD883627683A7A4325F3F82388E8C6BBC5D97E9D0997C4

Function 0106D0F8 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6855c3a0d5362879233e46a0f196b656e4da28da33b9e0b4b46673e9f574934d
Instruction ID: 2631273bdfd64c685a598cb24206ae3a18ed058520ee0d699b9a7ae8dba5ec77
Opcode Fuzzy Hash: 6855c3a0d5362879233e46a0f196b656e4da28da33b9e0b4b46673e9f574934d
Instruction Fuzzy Hash: 9A81ACB3F106214BF3444C78CD983A266839BD1321F2F82788E5CAB7C9DC7E9D0A4284

Function 010D22A3 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23d10403701027650913f0ea84e26101978f553377805a4570cf87fc75dfc6f2
Instruction ID: a284ca738c44bd3c6fdafbd2d9fde4f38e6098ede2451598df70999119324557
Opcode Fuzzy Hash: 23d10403701027650913f0ea84e26101978f553377805a4570cf87fc75dfc6f2
Instruction Fuzzy Hash: 1D816CB3F5152147F3584838CD693A26582EB90715F2F827C8F9AAB7C9DC7E9C0A4284

Function 01012374 Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75546382469c2df1115f64423f4c2dd3bc51537e1de3303dcde6935944566e01
Instruction ID: 5082c54072f2df6a11e08fa73f922af40773240ff3b1bb0d4665bda177aa4635
Opcode Fuzzy Hash: 75546382469c2df1115f64423f4c2dd3bc51537e1de3303dcde6935944566e01
Instruction Fuzzy Hash: 6B817EB3F116254BF3544D78CC983623293DB95315F2F82788E98ABBC9D93E9D095384

Function 0107B1C0 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40b77ffd99517b609ae7f225798078bd759944511ded10956c1ce0544ced46c4
Instruction ID: 639096c3f76e8993f73f82d8b3edec7da1f9e39e39ada701ef46982c20e52c8a
Opcode Fuzzy Hash: 40b77ffd99517b609ae7f225798078bd759944511ded10956c1ce0544ced46c4
Instruction Fuzzy Hash: 15817CB3F115254BF3544D68CCA8362B683DBD4325F2F82388A596B7C5ED7E9C0A9384

Function 010941FE Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4754aa53e955e7e36f8e79c1419c9ae3777c7e7bc9e892c2b30be2cc7982a333
Instruction ID: 1653aac1502e81544b7cfc3338ec409ffd33bb6299643e3ffdd05ead32963267
Opcode Fuzzy Hash: 4754aa53e955e7e36f8e79c1419c9ae3777c7e7bc9e892c2b30be2cc7982a333
Instruction Fuzzy Hash: 64818AB3F1162447F3440D28CCA83627683DBD5325F2F82788E596BBCAD97E9D0A5784

Function 01025047 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4df2a19168dc306a15acc44b7903b8d5fb67b1bfe764e7d2c16e0d53d0aed47d
Instruction ID: 6134c5de4418ebda814af4f378633eddabb6e57c3254720015e4b4fbc303af8e
Opcode Fuzzy Hash: 4df2a19168dc306a15acc44b7903b8d5fb67b1bfe764e7d2c16e0d53d0aed47d
Instruction Fuzzy Hash: 0281CFB3F1152587F3580E68CC683B27293EB95311F2F427C8A59AB7C1D97EAC099384

Function 01034572 Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 740bbfee751d1597585a205681fa2d6e7b7b82c10cd934d991e5c58c7192313c
Instruction ID: edcb8badebf3ceb0670ce8dca691777eb79102c32a66b78d92574fe907f020f4
Opcode Fuzzy Hash: 740bbfee751d1597585a205681fa2d6e7b7b82c10cd934d991e5c58c7192313c
Instruction Fuzzy Hash: 6E818DB3F6162547F3544C78CD98362A683DB90325F2F82788E596B7C9C97E5D0A13C4

Function 01035585 Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d38588fc23fc774f89a7d715784e26b8dea1767302592acf61b280746779eb9
Instruction ID: 7ae89b30617f72367d8c9406d406e1149d4812040442aac1b7e2faeff6cbfad6
Opcode Fuzzy Hash: 1d38588fc23fc774f89a7d715784e26b8dea1767302592acf61b280746779eb9
Instruction Fuzzy Hash: 3881CCB3F116214BF3544D68CCA83A27683DB95315F2F827C8E986B3C4C97E6D099384

Function 0107333E Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bbf58c23c079711d512dc28aa404b995bc5b55230ff4066758b158134b47f43
Instruction ID: 9886b7aa207fbd1c6df310fdf54ea44950ed1afeea51c0f4cad4d5c301cf8f6f
Opcode Fuzzy Hash: 3bbf58c23c079711d512dc28aa404b995bc5b55230ff4066758b158134b47f43
Instruction Fuzzy Hash: 92818BB3F1062187F3584968CCA83A27643EB95315F2F82788F4D6B7C5D97E9D0A5384

Function 0104B19E Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b059a14901d7efcfbefe1088e7d82582e430243f23e6bda1198ca4841f3e1d21
Instruction ID: f818e8e7c593f0ff964ed0a5e465166ceeb29822f010af358e72406fe47ac49a
Opcode Fuzzy Hash: b059a14901d7efcfbefe1088e7d82582e430243f23e6bda1198ca4841f3e1d21
Instruction Fuzzy Hash: 3D718CB3F116254BF3944879CD98362658397E5324F2F82788F5CABBC6DC7E5C0A5284

Function 010371EF Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d62624619cb4277d2099e0e250abbb6efe511027629226c71c6a2ecd8d5d348
Instruction ID: b22cb53875f0875d2cbb6950cc7dd1579cd2dcb07fbf9ccbe4f8acc78f8af7c2
Opcode Fuzzy Hash: 1d62624619cb4277d2099e0e250abbb6efe511027629226c71c6a2ecd8d5d348
Instruction Fuzzy Hash: AE8144B3E1152547F3844964CC58362B283ABE1321F2F81788E5C6B3C5DE3EAD4A97C4

Function 0107C0FB Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d7e955f79f963b36336804a200ccd99b268bb0dc1b31dea5e9c7eb6d706a898
Instruction ID: 524bb48f5869a83c1fec46fa001dc1eb7f4aee060bd4c5dde00deb722c168dc8
Opcode Fuzzy Hash: 5d7e955f79f963b36336804a200ccd99b268bb0dc1b31dea5e9c7eb6d706a898
Instruction Fuzzy Hash: 3981A9F3F5162547F3444868DCA83A2668397D0324F2F82388E5C6BBCADD7E8D0A5384

Function 010903E6 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c947a4d3b1907232a12861a7ddc8bea5442b96132e011790a84db8ff728f9455
Instruction ID: ef71c061f28ff1d06ce22fab634313e3ff899937dc8419136a6e13ccf63f58ed
Opcode Fuzzy Hash: c947a4d3b1907232a12861a7ddc8bea5442b96132e011790a84db8ff728f9455
Instruction Fuzzy Hash: CF818CB3E105358BF3504E28CC983A27692DB95321F2F46788E486B7C9DA7F6C0993C4

Function 0108C021 Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb1877c1aeebe1f9d534166a8e4ccf3672f73d6a32b160f2b95fb9cf4489c734
Instruction ID: 914aedf869418813e9a4348be5bc5fc565d0e27986350fb1725f23bdf5dc9b20
Opcode Fuzzy Hash: eb1877c1aeebe1f9d534166a8e4ccf3672f73d6a32b160f2b95fb9cf4489c734
Instruction Fuzzy Hash: 34819BB7E115264BF3844D64CC583627693EBD0321F3F82388E586B7C5DA7E9E0A9784

Function 0105B09B Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e040f37f4a08acfc9dfad01082584f52b69710ca9ad5d20063d85537bcd2b3bd
Instruction ID: e7b150467a11948c9a5640f51e8d5c37cdf7b466b971cba4bcf9904a045cfcd8
Opcode Fuzzy Hash: e040f37f4a08acfc9dfad01082584f52b69710ca9ad5d20063d85537bcd2b3bd
Instruction Fuzzy Hash: B0719DB3F106254BF3404D69CC483A276939BD4311F2F82388E5C6B7C9D97EAD0A5384

Function 0107155A Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e188e53f2134a6c4b792ea3639df4f2874cc9e0e9df4478659900d21de793d7c
Instruction ID: 971caebf28f4693057cfb99f6f983b08c7e4c2ef8f93fdc4d88f8adc2919417e
Opcode Fuzzy Hash: e188e53f2134a6c4b792ea3639df4f2874cc9e0e9df4478659900d21de793d7c
Instruction Fuzzy Hash: B6717DB3F116214BF3944D78DC983626283EB95315F2F82788E4CAB7C9D97E5D095388

Function 0107B585 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c209167f5a40ff065af482c179ef745cd0d3ea7575704259dc44cdf12138b68
Instruction ID: 4af1dbded908d0c64c4492e63cada01b9136c68d196cb63f75cc1ef34b3b1a4c
Opcode Fuzzy Hash: 6c209167f5a40ff065af482c179ef745cd0d3ea7575704259dc44cdf12138b68
Instruction Fuzzy Hash: B57157B3F1112547F3584D68DC683627293EB94311F2F823C8A8AAB7C9DD3EAC095384

Function 010B726A Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fa0a6fb11966b822db785ad9594170caa1a41f889b3c6e9ddc505cf6fc92b56
Instruction ID: c47c5e4acec4a5574720ec57b561283c156cab339c39f5c5866a341cd2be0306
Opcode Fuzzy Hash: 5fa0a6fb11966b822db785ad9594170caa1a41f889b3c6e9ddc505cf6fc92b56
Instruction Fuzzy Hash: F97179B3F112254BF3584839CD6836269839BE1320F2F42798B9DAB7C5DC7E9D0A4384

Function 010484BB Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ead60846dc45d9510ab80104a37ce05d6753a57efec6dc2eed8b355c638a1fd8
Instruction ID: dfe440eef3c60ee36ec6bcb78a26e9344a0b0036fdf7d7a8e710b1185ad03c0e
Opcode Fuzzy Hash: ead60846dc45d9510ab80104a37ce05d6753a57efec6dc2eed8b355c638a1fd8
Instruction Fuzzy Hash: CF719FB3F216258BF3844D64CC883627792EB95311F2F81788E4CAB7C5D97EAD099784

Function 010C41C5 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5eb671d6443fb2898621580e0d9ee96e74c0ce946ec0ce023b9abc0480ec8adf
Instruction ID: 9526c7d9e472e32c2fa509f1a7e2e25871912b0ccce6b1e3b88b61f9d604674f
Opcode Fuzzy Hash: 5eb671d6443fb2898621580e0d9ee96e74c0ce946ec0ce023b9abc0480ec8adf
Instruction Fuzzy Hash: EE71CCB3F1152587F3540D68CC683A2B293EBA5321F2F82BC8E596B7C9D93E5C095784

Function 0109E1E0 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75444911bebf42edfdd899f084f0b88a79c77f827e6f1778ec0648ff86171f18
Instruction ID: 4d6731695cdf8d8321560cc1f12db120219a31eedcb89b1cae73a6245888c4da
Opcode Fuzzy Hash: 75444911bebf42edfdd899f084f0b88a79c77f827e6f1778ec0648ff86171f18
Instruction Fuzzy Hash: 0B718BB3F116254BF3540D68CCA83627683DB95325F2F817C8E886B7CAD97E9D0A5384

Function 0105F28A Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 482f1940f90348af4a92024ddf7d93e657459d5fca1d8074d3bfda84e19a1d6e
Instruction ID: 2cfcba94d1fd5c4eac1e36c50354cd9ac41648ce02e631615bb6922874073607
Opcode Fuzzy Hash: 482f1940f90348af4a92024ddf7d93e657459d5fca1d8074d3bfda84e19a1d6e
Instruction Fuzzy Hash: E67169B3F115244BF3844929CC683626283EBD5325F2F82388A996B7D9DD3E5D0A5284

Function 010CF0E6 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6574adb29a7456120ebbfbc2161768fa4990f28917557942d1d24611f2298442
Instruction ID: 1f9638073d3178f6c14294e9f87a478d1e837d5f64b0ed2314e791343e0b9598
Opcode Fuzzy Hash: 6574adb29a7456120ebbfbc2161768fa4990f28917557942d1d24611f2298442
Instruction Fuzzy Hash: C571AFB7F215254BF3440D28CC283627683DBA5321F2F82788A59AB7C5D97D9C0A5384

Function 010500F5 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9688f5c45af579de1c03da1d500a7b0e78b694e9958ee91fe77ea598d40dab43
Instruction ID: ea10b711c6e3fdd6c647c05bef741c5b74c74c204f261b26e61563b4a9769120
Opcode Fuzzy Hash: 9688f5c45af579de1c03da1d500a7b0e78b694e9958ee91fe77ea598d40dab43
Instruction Fuzzy Hash: 9571C0B7F2152187F3940E24CC583A27693EB95314F2F81788E49AB7C5D97E9D099384

Function 0109D48C Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52621f36e7a583b0c2c787f9fbc73affd73a772e0b51c1224e6042d19ecc42d6
Instruction ID: f6c322e743f2405ab55af7eabea2d2a08b03dfe8513eb54a9400d01c61539efd
Opcode Fuzzy Hash: 52621f36e7a583b0c2c787f9fbc73affd73a772e0b51c1224e6042d19ecc42d6
Instruction Fuzzy Hash: 67717AB3E115254BF3544E39CC983627693DBD4321F2F81788A4CAB7C9D93EAD0A9784

Function 01046319 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14e1b4d41d4e02a021d64785f01df7a1749fae28d0b63d06c0e11ee7ea3f4e4f
Instruction ID: 06c470086d254725b730817432867059cc15a67a7c1ab164fb3d75f84fc2b5e0
Opcode Fuzzy Hash: 14e1b4d41d4e02a021d64785f01df7a1749fae28d0b63d06c0e11ee7ea3f4e4f
Instruction Fuzzy Hash: 7A717BB3E1152447F3544D68CC583A27683DBA4321F2F82788E9CAB7C9D97EAD095384

Function 0107D262 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e56e57254118f34bc8ed6c5a39a0e2615e46ee41fab071cd2dea23275720fe27
Instruction ID: e286a24535639b27c0e8a42daf06d1190f382f547f647e63f0780e6753bfab50
Opcode Fuzzy Hash: e56e57254118f34bc8ed6c5a39a0e2615e46ee41fab071cd2dea23275720fe27
Instruction Fuzzy Hash: BF6116F3E082105FF708692DEC5533AB7DAEBD4320F2B463DDA95D7384E97858418282

Function 00FCE290 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9465a5f7516d963b648f85f5904761dbdb3ea1460de481607f9f9d5993709d7c
Instruction ID: 8207a1ce918321dfb56efa128c9830b72c7002d80656bd33b6a8aa96e973f3d6
Opcode Fuzzy Hash: 9465a5f7516d963b648f85f5904761dbdb3ea1460de481607f9f9d5993709d7c
Instruction Fuzzy Hash: F8614737B49AD18BD328893C4C227BABA934FD6230F2CC76DE5F6873E1D5658805A351

Function 0105C236 Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3afd32787b1fa58d555fb70f880842925af8c2ef19516596ca24df914eed3338
Instruction ID: 17b2397a3caf46877479c537ecf8d6440fafea9d7d50bc761738d4e36e7f1adc
Opcode Fuzzy Hash: 3afd32787b1fa58d555fb70f880842925af8c2ef19516596ca24df914eed3338
Instruction Fuzzy Hash: 1871B0B3F1162547F3504D68CC583627683EBE1321F2F82788E58AB7C9D97E9D0A9784

Function 0104C54F Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81a277324a01570ffeb5e49799f7089d2c2efa2520f5f5f6beb6aacdabb5aef3
Instruction ID: 7438fc3c4a886cc3bea2be4ca390596fcd14d25989918d798993a9b2af51cdeb
Opcode Fuzzy Hash: 81a277324a01570ffeb5e49799f7089d2c2efa2520f5f5f6beb6aacdabb5aef3
Instruction Fuzzy Hash: EE7179B3F416254BF3444D39CC9836276839BE5721F2F82788A485B7C9ED7E9C4A4384

Function 0108A002 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5a7cdd724ea43b0b4fa4ecec7af0a241ec37aaef3708bd578f58a8b920bbc46
Instruction ID: c74618c661f728981c8355fabf17d0f7405b2b4b4b1434dd568cf4ff13ac2554
Opcode Fuzzy Hash: f5a7cdd724ea43b0b4fa4ecec7af0a241ec37aaef3708bd578f58a8b920bbc46
Instruction Fuzzy Hash: F3719CB3E115254BF3948D28CC543A27283ABD4325F2F82788E9CAB7C5DD7E9D0A5384

Function 010785C7 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b841589c94e7185000eec8a516a0cb5359e2009d9ebb62e12993dc136707f460
Instruction ID: b9995b381e5141b89701f2b5a5ec5d367b7bd369256cc1b7793c15a822d84517
Opcode Fuzzy Hash: b841589c94e7185000eec8a516a0cb5359e2009d9ebb62e12993dc136707f460
Instruction Fuzzy Hash: 7871E1B3F2162447F3844D74CC993A26683EBA5311F2EC2788A599B7C9DCBDAD495380

Function 0105A292 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d677bde6c733c15cf52bad83988a77b92fbcc8928b6abdca38a434cf51b0001
Instruction ID: 3e02cddd0721d6f9e6b629a5be01b0c2f9370e76788d9f000804e11ce81562db
Opcode Fuzzy Hash: 5d677bde6c733c15cf52bad83988a77b92fbcc8928b6abdca38a434cf51b0001
Instruction Fuzzy Hash: 25616BB3F1152547F3584D28CC683A666839BD1325F2F82788E9D6BBC5E97F5C094384

Function 01012748 Relevance: .2, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a08c451ad17aee674c2bbb9b9fb3f3dc73f16ca5ebb28f2765d506cb8fe50f68
Instruction ID: 4f0867f8d1f8d15fa0adec7093b30626ef077a8075f4eb8a280870fbe3ea7671
Opcode Fuzzy Hash: a08c451ad17aee674c2bbb9b9fb3f3dc73f16ca5ebb28f2765d506cb8fe50f68
Instruction Fuzzy Hash: D6717BB3F1252547F3884929CC683A23643DBD5315F2F82788A4D5B7C9DD7E9D099384

Function 010A347D Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10332d506277aea5fec583eb8aa9ca862ce488862cdadbe9a605aa781ff97041
Instruction ID: 704f8da66ed3e70dae3ab269e6a67c233633abfac6ab26ccac74410b50ff1a92
Opcode Fuzzy Hash: 10332d506277aea5fec583eb8aa9ca862ce488862cdadbe9a605aa781ff97041
Instruction Fuzzy Hash: 84619AB3F1162547F3584964CC683A27683EB94321F2F82788E9D6B7C5D97E9C0A43C4

Function 0109D191 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 073f96c642714d832fed248524447666dc4755816e02bdd973d535765ca2fb53
Instruction ID: f5529f75f05d8e24ef1237789968f0bf5d7010764436e85f832406fd8d73af43
Opcode Fuzzy Hash: 073f96c642714d832fed248524447666dc4755816e02bdd973d535765ca2fb53
Instruction Fuzzy Hash: 2161E273F502244BF7984D68CCA93A23292EB95310F2F417C8E899B3D5DD7E6C099784

Function 0104B569 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e12f8735fe537c26e655b3355d0c3f97c95512d69656006cd9e24e6d0c68670
Instruction ID: 20195e1f37b4746ba3ff6cef0d85110eca6f284d0d6c43ca116082e8d2b74a61
Opcode Fuzzy Hash: 0e12f8735fe537c26e655b3355d0c3f97c95512d69656006cd9e24e6d0c68670
Instruction Fuzzy Hash: 08618EB3E1052587F3644D79CC58362B693DBA0321F2F82788E9CAB7C5D93EAD095784

Function 0103612B Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2044076d6a6e90fe52b55b2c56a35e630c17c0cdb415f2fa14352ec611353ec
Instruction ID: 9b7ee465405de9be0ae966a072f642069632f882d4410efa5ccdb3ed4db465d8
Opcode Fuzzy Hash: a2044076d6a6e90fe52b55b2c56a35e630c17c0cdb415f2fa14352ec611353ec
Instruction Fuzzy Hash: BE618CB3F2152547F3544D28CC583A17693EBE1321F2F82788E486BBC9D97EAE095384

Function 010D1290 Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 493d4f75610ff9fcf812fb748e355cd34042ef9198403621122b53d3919637e8
Instruction ID: d231b6762af8a706d9c63673aa216166fae4e92a1f1073b1e6c67af90024fd95
Opcode Fuzzy Hash: 493d4f75610ff9fcf812fb748e355cd34042ef9198403621122b53d3919637e8
Instruction Fuzzy Hash: A6619DB3F112118BF3544E28CC983A2B793EB95314F3E81788A485B7C4DA7E9D099784

Function 00FE85E0 Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 569bc42185aa740b73b2156122c497ff72d6df04bb91fa248592e3bcb7fa7090
Instruction ID: 8d54e53dbd17fd8d2eab6957a7d47df3cd9f5a17fae53eac2639241e149c3940
Opcode Fuzzy Hash: 569bc42185aa740b73b2156122c497ff72d6df04bb91fa248592e3bcb7fa7090
Instruction Fuzzy Hash: A651F271608341ABD710AF2ADC45B3BB7E6EF81750F10882CE48997192DB75DC06E7A2

Function 010620B8 Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b742ed8fc0126d7935c49a89613a5843f0749f7c20442368825aff73d43fbf8
Instruction ID: abae5724e8a3ae32c5cd653590fc8397bf4f3f9de41290acc49ac4f865405638
Opcode Fuzzy Hash: 5b742ed8fc0126d7935c49a89613a5843f0749f7c20442368825aff73d43fbf8
Instruction Fuzzy Hash: E6517CB3F1122547F35448A9CCA8362A28397D4325F3F82398F5D6B7C5E9BE5C0652C8

Function 010623BE Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3b791182c30da46c7417ee8ac275494edcba4255986c425c8d316926436077b
Instruction ID: 9d9e36dda327d955d1bc7eaa5bd9274cb9db16a7fb37a33aefd186447324b53a
Opcode Fuzzy Hash: c3b791182c30da46c7417ee8ac275494edcba4255986c425c8d316926436077b
Instruction Fuzzy Hash: 1C618BB7F216254BF3844964CC983627283DBE1321F2F82788F686B7C9D97E5D0A4384

Function 00FE7500 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0288cd3b192f347070e81ea7353e08bb5565fcf5553c08da131d7bc18d8c1a13
Instruction ID: 65f2df363cdf39facd08248090e4138a3a2435e31ccfde46d693e36ff59a0968
Opcode Fuzzy Hash: 0288cd3b192f347070e81ea7353e08bb5565fcf5553c08da131d7bc18d8c1a13
Instruction Fuzzy Hash: 5D515CB19087548FE314EF29D89475BBBE1BBC4318F044E2DE4E987350E779DA088B92

Function 010AA08D Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 118a8fcbe1b69341ac2f90943ebc1a9bf40b77b59a25590d9c7bc683168decfe
Instruction ID: ce4b56dceaf9171b6bbea828a9501fcfe117e9e0874da3777772c395ec444d61
Opcode Fuzzy Hash: 118a8fcbe1b69341ac2f90943ebc1a9bf40b77b59a25590d9c7bc683168decfe
Instruction Fuzzy Hash: 545169B3E1162547F35449A9CDA8362A683DBE0321F2F82788F4D6B7C6D97E5C0652C4

Function 01015309 Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11c16810c95387c89c0a7e161a51f3a70d44772278e94ff73641856d5f90d858
Instruction ID: 73b36894e382000acc8f0df91fa0233930004464dc755a1a35cf827f2bfb87ff
Opcode Fuzzy Hash: 11c16810c95387c89c0a7e161a51f3a70d44772278e94ff73641856d5f90d858
Instruction Fuzzy Hash: 77519EF3E10A2447F3944D65CC983A27282D7A5321F2F82788E686B7CAD97E6D095384

Function 010AB08B Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce9424f3d16a87ad979c1efa36ad4f978e2dbdf5c63e807d89b7f9d729f09340
Instruction ID: d61103aa4c4eaf45b757dd8b0501654fecf02fdd2871a5189791434f4c9d751b
Opcode Fuzzy Hash: ce9424f3d16a87ad979c1efa36ad4f978e2dbdf5c63e807d89b7f9d729f09340
Instruction Fuzzy Hash: C051D2B3E106254BF3544DB8CCA83627692DB95320F2F427C8E58AB7C5D97E9D099384

Function 0108B0A3 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e12992080e3c39c10b115e683c16eb7e1b74d9dce1ab74ac756e615d1a5d5b3d
Instruction ID: d4d5dea4ba9f11cc42bf4288d84a0c249542af287c38223b2f0c75b7673fe2a5
Opcode Fuzzy Hash: e12992080e3c39c10b115e683c16eb7e1b74d9dce1ab74ac756e615d1a5d5b3d
Instruction Fuzzy Hash: ED517BB3E1163543F3504969CC983A276439BE1325F2F82788E5C2BBC6D97E6D0953C4

Function 0102C33D Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7151abed27c69498cb540d7f39a6a5e3533643e964b6e92dfb33e3fa476b500e
Instruction ID: a1675ec03f35379866faf96caf21d7847c779edbc4a276d9870bf6efad7c5234
Opcode Fuzzy Hash: 7151abed27c69498cb540d7f39a6a5e3533643e964b6e92dfb33e3fa476b500e
Instruction Fuzzy Hash: B3516AF3F6152587F3544869CDA83A2258397E1325F2F82788E9C6B7C9ECBE5D094384

Function 01056326 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff0032817bf7b8f47844e6c139b6daae1c0e581085319667e68df4c5931ab684
Instruction ID: 53b0ba74b16316c4effb206cb3f4fa65735ef1c74d648125c6aa2da8d9e84b2e
Opcode Fuzzy Hash: ff0032817bf7b8f47844e6c139b6daae1c0e581085319667e68df4c5931ab684
Instruction Fuzzy Hash: 1151ADB3F2162547F3944CB8CD98361A68397D5321F3F82788A2C6B7C5DDBEAD095284

Function 0101C2C3 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2cb46f8fac3e7c8c6ef965b2be8cc1c35a106bcd6c3140d9f3778ac97cb8774
Instruction ID: a1e64d496a274c1d6f551f7b2fc1980ddcb86631d869c3b91be6625ed4083f58
Opcode Fuzzy Hash: f2cb46f8fac3e7c8c6ef965b2be8cc1c35a106bcd6c3140d9f3778ac97cb8774
Instruction Fuzzy Hash: B551ACF3E10A2547F3540878DD5836166929BA1328F2F42788F9D7B7C6E87E5E0953C8

Function 01087142 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc58b2cdf2f3f470135c692a6ad74e61ebf5ac1e06d2d3e275c6566d1f90c645
Instruction ID: b630f6ffa16e43e05ce5248226cde046eea00e0b2d72e96487db3f773500bf27
Opcode Fuzzy Hash: cc58b2cdf2f3f470135c692a6ad74e61ebf5ac1e06d2d3e275c6566d1f90c645
Instruction Fuzzy Hash: 29517DF3F1152547F3440D68CD983623642DBA9311F2F42788E5CAB7CAD97E9D0A5788

Function 00FC7380 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: eba13c3e4949645a8745d03d98ab3cbb5ff36a97c30c273f20e7025bb9bcf4e8
Instruction ID: f16a5a6089ebb289b44793244574f5b5a268278cbcdd6d23b1b37a1049415ebb
Opcode Fuzzy Hash: eba13c3e4949645a8745d03d98ab3cbb5ff36a97c30c273f20e7025bb9bcf4e8
Instruction Fuzzy Hash: 9A417837A08741DFD328DF98C881B7ABB93BBD5320F5D552DC4C527222CAB06841AB86

Function 00FD36E2 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab05654e65ec28b47ce203cf4b04c5d41ec25e9160b4116a69e75f8763896f4c
Instruction ID: 2e46b392f5fc87b621e794fa7a4b70aca36c99d7bb756b2832a251c38be33efb
Opcode Fuzzy Hash: ab05654e65ec28b47ce203cf4b04c5d41ec25e9160b4116a69e75f8763896f4c
Instruction Fuzzy Hash: 67418875A05206CFD708CF68ECA07BAB3BAFF49301F1984A8D545EB390DB71A851EB50

Function 0105725D Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 507f5dd5adf98baf38bab3330697c54be00b82c46158a44a22633516a5f68d50
Instruction ID: 0644a3856e69678bfd64b145e786a03e1636887ce360a1a24bcc8e90450e656d
Opcode Fuzzy Hash: 507f5dd5adf98baf38bab3330697c54be00b82c46158a44a22633516a5f68d50
Instruction Fuzzy Hash: 4E519DB3F1162547F3504D29CC583627683ABD1325F3F82788A986B7C5D93E9D0AA384

Function 010B156A Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b81558106b303f1f5f880f6bc541e3592f65f3613cb446d57dba9b6cc17152e0
Instruction ID: fb439c570a8ec0f0db26ab0e34fb562abf45ffa2e653443e046bdb6946abf314
Opcode Fuzzy Hash: b81558106b303f1f5f880f6bc541e3592f65f3613cb446d57dba9b6cc17152e0
Instruction Fuzzy Hash: D351AEB3F206258BF34449A8CC983A27643DBD1316F2F82788E485B7C9E97D9D0A4784

Function 0103B5FC Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ad0a3b946bc852a1f6ddfd84cfb4e38ecb7ae78d6af9fb5d80a90b6b18323ba
Instruction ID: a20b6ade9cdc958c9debb81d12b9c25d0a2a3741e9d3a51c837c956198e5c809
Opcode Fuzzy Hash: 3ad0a3b946bc852a1f6ddfd84cfb4e38ecb7ae78d6af9fb5d80a90b6b18323ba
Instruction Fuzzy Hash: 7C417CB3F529254BF3544969CC543A266839BD5325F2F82B8CA9CAB7C9DC3E4C0A5384

Function 0102235C Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9ff40c75de4d2b7ad5333e34f7fa2d12820db275d1fa15995c86c3c6aad1922
Instruction ID: 96ac5043b9684eacd87a4e681d16d2b58254bc691d8271c4f775e69b02ecafe8
Opcode Fuzzy Hash: a9ff40c75de4d2b7ad5333e34f7fa2d12820db275d1fa15995c86c3c6aad1922
Instruction Fuzzy Hash: AA418DF7E115254BF3904878CD583526582EBD1324F2F82748E9CABBC9D87E9D0A57C0

Function 00FD86C0 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54353ab4c6158592ce83548e8f51c19162092a41c5f37e37d9cb0b2ab6cf117f
Instruction ID: 4f003eef52bf6096982ea9050aeccb1db8854a9aa789fc8646f5c5c491c913f2
Opcode Fuzzy Hash: 54353ab4c6158592ce83548e8f51c19162092a41c5f37e37d9cb0b2ab6cf117f
Instruction Fuzzy Hash: 7541D5B1E102285FDB24CF788C5279EBAB6EB55300F1581ADD449EB285D7340D468F91

Function 010B94A4 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a27c7c1008c8337ac9b66dfb1726736b114f9f8d28d87fff56a7d4568bc7e396
Instruction ID: 598a4927d7753e236a1fcf76aea1a582af0594f6abd64e8531e903ec37e84066
Opcode Fuzzy Hash: a27c7c1008c8337ac9b66dfb1726736b114f9f8d28d87fff56a7d4568bc7e396
Instruction Fuzzy Hash: B23167B3F5162147F3984839CD58396668397D4324F3F82798A9CAB7C6DCBE9C0A0384

Function 010C806F Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 892c227413ee2f0ad733ed125596d1f30af9226a81ae931e913576f78388ee55
Instruction ID: 3bad96c5f6a1c84a8579e473a1dbb750a4de9ced3b959af88150c68912ac8c10
Opcode Fuzzy Hash: 892c227413ee2f0ad733ed125596d1f30af9226a81ae931e913576f78388ee55
Instruction Fuzzy Hash: C73144B3E6252547F3984875CD683A2248397D5325F2F83788E6C6BBC9DC7E0C0A52C4

Function 010AB594 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8e9cdec2127569c0a699eef6ff852bef9597f42a609562d696a4a6f0c9cb6fa
Instruction ID: 35ad22e1862bcba852888725633e3ee68bd92c7b1fda231fee24cf2f0b585b6f
Opcode Fuzzy Hash: e8e9cdec2127569c0a699eef6ff852bef9597f42a609562d696a4a6f0c9cb6fa
Instruction Fuzzy Hash: 4F319AB3E5152587F3504D28CC683A272839BE5321F2F82788A5C5B7C5DD7EAC0A9784

Function 010703DE Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62238adfd5db695cbb4a7838869182b4c2235a122ce4ec0d15a2616c469199e6
Instruction ID: 25b3438ab1b4683e3d7ba8e82245381b4b611ec818d9168c619e77ba7236c959
Opcode Fuzzy Hash: 62238adfd5db695cbb4a7838869182b4c2235a122ce4ec0d15a2616c469199e6
Instruction Fuzzy Hash: C6317AB3F005214BF3944968CCA8362A243DBC1325F3F82798A5D2BBC5DD7E5C0A5684

Function 0107A537 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 397f763e724bc6f61737f36df6ad66de53b76ca8d497c0a2c291fa76612df601
Instruction ID: e92d81d4dbce1eeae2e5542e98cec07fc3bb25b51aeff0b4df894af0151fb3cc
Opcode Fuzzy Hash: 397f763e724bc6f61737f36df6ad66de53b76ca8d497c0a2c291fa76612df601
Instruction Fuzzy Hash: 06315EB3F5157543F3544878CD583A15593CB91325F2F82389F58ABBC9D8BE8C0A1284

Function 010CB449 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 583466c0a257179b362e8565fece8dce765b42bf905c3e7e8ec9c8e5d80122ca
Instruction ID: 1c4d82615a411b963d64088d82dcb0221c8daeb6426e0b2327ba8aef23bded5b
Opcode Fuzzy Hash: 583466c0a257179b362e8565fece8dce765b42bf905c3e7e8ec9c8e5d80122ca
Instruction Fuzzy Hash: F6316DB7E116314BF3944878DDA93626942A790320F2F82798EAE3B7C2DC7E1C0917C4

Function 01037067 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 948925f4f7bc68d7255c44bb619a21b2b3fdfd7d3fe00ac3a26866647b582567
Instruction ID: 6425a259d06c7977ad6faf3405e2fdcebaf465dcc75723ac0f0a6e3170211f71
Opcode Fuzzy Hash: 948925f4f7bc68d7255c44bb619a21b2b3fdfd7d3fe00ac3a26866647b582567
Instruction Fuzzy Hash: ED312EA3F5062107F34848B9DDA93B625C397D4315F2F82398E69D77C5EC7D9D0A1284

Function 010A6447 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e40d6b7b1ea188bfa147f4919bb021217d144c592a0dcbe33f8d347a3237d292
Instruction ID: 9a7a2d702edbeea92c78f4ccc857ac1502fe55c0d1a634fa8f58c7c55c8a4b9d
Opcode Fuzzy Hash: e40d6b7b1ea188bfa147f4919bb021217d144c592a0dcbe33f8d347a3237d292
Instruction Fuzzy Hash: 683146B3F5162007F7584878DDB836655829BA4324F2F427E8B1EABBC9DC7D4C0A02C4

Function 01076165 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7795b19ceed41663eaac9a1120173965bad929276ed5fd3c5adb04bd836e80c3
Instruction ID: fe16d64b96b9b722068a3e8ed01314a81916c8a8ff546e32b8ab8640f5ad7c0b
Opcode Fuzzy Hash: 7795b19ceed41663eaac9a1120173965bad929276ed5fd3c5adb04bd836e80c3
Instruction Fuzzy Hash: 1B3146F7E51A3107F39848B8DD593A2A0829B95315F2F82798F1DBB7C5E87E4D0912C4

Function 010201DC Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afcf547c73392e559383337c1c526e1ef64b6dbb4493babeed0a62088afe7323
Instruction ID: b774a41cff59ec2ea561841e62576d55c4c2008349763ddca1880e07fb845565
Opcode Fuzzy Hash: afcf547c73392e559383337c1c526e1ef64b6dbb4493babeed0a62088afe7323
Instruction Fuzzy Hash: 75311DF7F517220BF34448B9DD98362558397E1716F2F82398F4CAB7C5D8BD890A1284

Function 0104E463 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38b376ef0f5aa2570ee0ce7adef0b6082370a225d6030ac9daa33c1be5ddf9fa
Instruction ID: d9186543f99bd776aec5f60a7126c8cf3ae60c056522d4464d9e2265b80b08b6
Opcode Fuzzy Hash: 38b376ef0f5aa2570ee0ce7adef0b6082370a225d6030ac9daa33c1be5ddf9fa
Instruction Fuzzy Hash: B0319FB3E509354BF3904879CD983B265429B95325F2F42748E0C7BBC5D9BE5D0A63C4

Function 0104D109 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 944c79c6353e1b320c812fa5feae1bdd0feab01720a83445f8dd64fce073171d
Instruction ID: 781937ce768fac71005d2b821d8b3ab436d8d5131a5c175603ab653bc2157712
Opcode Fuzzy Hash: 944c79c6353e1b320c812fa5feae1bdd0feab01720a83445f8dd64fce073171d
Instruction Fuzzy Hash: A33119E3E1163547F39444A9CD683625582D7A4325F2F86748F5CBBBCAE87E8D0A12C4

Function 010AF4EE Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93e21039968ca09cd6350e3314229c0e8f4f2489028fc30bfbbcd2834f33ece0
Instruction ID: 550e749b77d33a7b95f2d633ec57e901907926ef750285677b04370fff98df67
Opcode Fuzzy Hash: 93e21039968ca09cd6350e3314229c0e8f4f2489028fc30bfbbcd2834f33ece0
Instruction Fuzzy Hash: C2314AF3F2193107F3588869CD693A295838BE4325F2F42798F4D6BAC5D8BD5C0A12C4

Function 00FED34D Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1e6ef65c4f59ed9191d0b55a7bf8b8479ee371e6f64e4fdcbcf076735a05bf0
Instruction ID: 10dfe4a781e8df9c10a265e2e06fca341e4f0efc9fe970b39b0d734531e0190c
Opcode Fuzzy Hash: b1e6ef65c4f59ed9191d0b55a7bf8b8479ee371e6f64e4fdcbcf076735a05bf0
Instruction Fuzzy Hash: 2121F332E083900FD719CE39889113BFBE79BDA224F18D63DD4A6972D5CA34E9068A45

Function 010674A1 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0607789e1b8b9835a3763e76a92f1b25f7c7d8a428e3fd2a21c705e6b1e52b81
Instruction ID: c51bd1d89eaabc984ee53999aadabaa885ba0e0b868d92b07d4659b015779b00
Opcode Fuzzy Hash: 0607789e1b8b9835a3763e76a92f1b25f7c7d8a428e3fd2a21c705e6b1e52b81
Instruction Fuzzy Hash: 6B3116B3F1152147F394443ACD583A665838BD1315F3BC2788E686BBD9D87E8D4A5284

Function 0109B02D Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d50b4690b6dc472de089294ea634a2b8c55d03a0ee8dc56b63fe49004feea636
Instruction ID: b6a8c01ac73cd467140e4ce9ecb0e6362952773fd38028387739eda9c03a8ae2
Opcode Fuzzy Hash: d50b4690b6dc472de089294ea634a2b8c55d03a0ee8dc56b63fe49004feea636
Instruction Fuzzy Hash: E03139F3F61A214BF35448B4CD9836265429BA5325F2F82748F1C7B6C6D87E9D0A52C4

Function 0108F1A9 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 408e13496a3e926a1b78f7f3862dc4f1fc6e7e56025ebf8547aac5c305e682b6
Instruction ID: e691da2a982c778db281d5e806acbd841fa206624ee8cc210ab6a266343e7810
Opcode Fuzzy Hash: 408e13496a3e926a1b78f7f3862dc4f1fc6e7e56025ebf8547aac5c305e682b6
Instruction Fuzzy Hash: 83214C73F103254BF39448B8DDA93A26582DB85320F2B82798F596B7C5DCBE5C4A5280

Function 0101E3D3 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a856fdb9fd710fe82b437c3714adce07fef830a41326f683f4aeac41918df487
Instruction ID: 947adb42fe05bc78cdda405fe2251e10343852c7118a0bf3de2aede746ad3eff
Opcode Fuzzy Hash: a856fdb9fd710fe82b437c3714adce07fef830a41326f683f4aeac41918df487
Instruction Fuzzy Hash: 293139F7F919214BF3408879CD58362258397D5325F2F82788B2CABBD9D87D8D0A5284

Function 010C7559 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45b66efc912e2df649c001a051551c1f38b71d90fe3d9dfb65fc23ee54633969
Instruction ID: d4b18794582ec798437d761ea596ac53b84b08c25b71679c3cdb877d7701a4d6
Opcode Fuzzy Hash: 45b66efc912e2df649c001a051551c1f38b71d90fe3d9dfb65fc23ee54633969
Instruction Fuzzy Hash: 37214DB3F6062647F3604C78DE48362AA839BD1311F2F42748F0CABAC9D87D9D196280

Function 010515DA Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab6ab3816f85ff94968a2bab3f6df598d6a1fc959c7af6eeae2b90de74022283
Instruction ID: 8df6ccc496cea429df2cbf52d000787d680cfec536423f81999b2832a2d1672b
Opcode Fuzzy Hash: ab6ab3816f85ff94968a2bab3f6df598d6a1fc959c7af6eeae2b90de74022283
Instruction Fuzzy Hash: AA215BF3F516250BF34848B9CCA4362658397D8725F2B82788F5DAB7C5D8BC5D0A1288

Function 0102A568 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 712fe3725f2d174e300abf48afd57ba19d3ab30c85d0b68ae499efd1af2d25cd
Instruction ID: b3bec9838d45e1cd4b5d2e58fc588495ba65cea8ac86c139e330113911516394
Opcode Fuzzy Hash: 712fe3725f2d174e300abf48afd57ba19d3ab30c85d0b68ae499efd1af2d25cd
Instruction Fuzzy Hash: 55212CB3F1063507F36448B9CD9836294839BE4715F2B83388E9CABBCAD87E5D0952C4

Function 01096524 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51d8fd995e0a73bf1c9e3719163059db89ca87a5cc848ec1f18aff1b34d5d4e1
Instruction ID: a2ec15aa63dd10c4de952957a73ab5cc4497e8fb5e6effc2ef750e4aec430119
Opcode Fuzzy Hash: 51d8fd995e0a73bf1c9e3719163059db89ca87a5cc848ec1f18aff1b34d5d4e1
Instruction Fuzzy Hash: 17219DF7F51A250BF38448A5CC98362254397D5325F2F82388F186B7C9CCBD4C0A1388

Function 010A739E Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7aa967b6109332184ae8705d43f3676b60a38f371be0d6ffd7be0d6c3764954
Instruction ID: 07b8fe8b7b62e7d4cc1956ba113e3d49ebbbd533f162f4bb952c5d329bca4df4
Opcode Fuzzy Hash: a7aa967b6109332184ae8705d43f3676b60a38f371be0d6ffd7be0d6c3764954
Instruction Fuzzy Hash: F2212BB3F105254BF358886ACD58362A58397E4315F3B82388B5C5BBDAD8BE9D0B5284

Function 0100A3B9 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0962afeb6ed1bbecfb66832c585365df33bb565b4545c624c379ba25352dcc47
Instruction ID: 2e2608b2f94b35e19c876caf70a652f79ce4984c07f4f05878594a2460f4aaa3
Opcode Fuzzy Hash: 0962afeb6ed1bbecfb66832c585365df33bb565b4545c624c379ba25352dcc47
Instruction Fuzzy Hash: 792190B3F6152647F3644D78CC953A272839B92321F2F43788D68AB7C5DC3E9D096284

Function 0107B468 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae48a50eab7235b45381915a0a4bd4c38a53188f1634c53dba91a804612a1706
Instruction ID: 4af723a86c0116d92e77093dd63d85be7850381905bb9ee385b287b8d1757c7c
Opcode Fuzzy Hash: ae48a50eab7235b45381915a0a4bd4c38a53188f1634c53dba91a804612a1706
Instruction Fuzzy Hash: 7C215BB3F516254BF34448B8DCA93A26583DBD5318F2F82398F48AB7C9D87E5C0A5384

Function 010B60E2 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 869d4f4f00c4426b5eab34ef6a863108bc9b88ce488bc50a605dc23c3f037965
Instruction ID: 2990603a077fe089539333d6c957a2517741d42e571f9ed674ee14f8d9400ba3
Opcode Fuzzy Hash: 869d4f4f00c4426b5eab34ef6a863108bc9b88ce488bc50a605dc23c3f037965
Instruction Fuzzy Hash: 09215AB3F916254BF350487ACDD836266839BD5310F2F4278CD4C6BBC9D87E8D4A5284

Function 00FE5450 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: 0442ca45243a38d0e4a7f86941a66f62a60f2be4f70ad7ef6a23b8cdd84804a7
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 5A11E533A055D50EC316CD3D8410565BFA31AA3A3EB6983D9F4B89B2D2D6228DCAA354

Function 0100A00D Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64e5c01bd95c86acd2612f85fbebe9f920b0337da46091b55fd2681b45cdec81
Instruction ID: 7e4459ccbf77d8c03a736fdab08dc0e48ada0b216a063e1d70f7d9ef4d824580
Opcode Fuzzy Hash: 64e5c01bd95c86acd2612f85fbebe9f920b0337da46091b55fd2681b45cdec81
Instruction Fuzzy Hash: E411167150921ECFFB669F94C0096AE7BE0EF01321F01891DDAC181984D7B55CA4CB6A

Function 00FD3086 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491188599.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1491174803.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491188599.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491230517.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001186000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000125F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.0000000001287000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000128E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491244239.000000000129D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491475437.000000000129E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491586728.0000000001433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491602748.0000000001434000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_2ZsJ2iP8Q2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201e36fa7ac1b7083b0576bc089ec60fd65358d7f911e70fbc6ee693e8412814
Instruction ID: c77909deb990851be9fa55280088392d0552f15bcacf8fa5c810d32fd5874fb2
Opcode Fuzzy Hash: 201e36fa7ac1b7083b0576bc089ec60fd65358d7f911e70fbc6ee693e8412814
Instruction Fuzzy Hash: 57E0ED75D11148AFDE006B11FC016297A66ABA1307B461171E408A3236FF355427F755

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2ZsJ2iP8Q2.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Boot Survival

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

Windows Analysis Report
2ZsJ2iP8Q2.exe

Function 00FBACF0 Relevance: 9.2, Strings: 7, Instructions: 430
COMMON

Function 00FB8850 Relevance: 1.7, APIs: 1, Instructions: 208
COMMON

Function 00FEC1F0 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Function 00FEC180 Relevance: 1.5, APIs: 1, Instructions: 35
memoryCOMMON

Function 00FEAAA0 Relevance: 1.5, APIs: 1, Instructions: 13
memoryCOMMON

Function 00FEAA80 Relevance: 1.5, APIs: 1, Instructions: 9
memoryCOMMON