Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1533076
MD5:	b2337b7ef8afe55b28bdc11d27a7f160
SHA1:	e64ab79ef63c59c372f603bad020982821d0d7e3
SHA256:	2a223c2207a017da91da53683dade893aa77b3ce2298a4e3cbd80f5d92296e44
Tags:	exeuser-Bitsight
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Hides threads from debuggers

Machine Learning detection for sample

Modifies windows update settings

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Detected potential crypto function

Enables debug privileges

Entry point lies outside standard sections

Found potential string decryption / allocating functions

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Sample file is different than original file name gathered from version info

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 5164 cmdline: "C:\Users\user\Desktop\file.exe" MD5: B2337B7EF8AFE55B28BDC11D27A7F160)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: file.exe

Virustotal: Detection: 56%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_011BB7F9 CryptVerifySignatureA,

1_2_011BB7F9

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: file.exe, 00000001.00000003.2180026789.0000000005560000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmp

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00FFC0FB	1_2_00FFC0FB
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00FF10F4	1_2_00FF10F4
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0101410C	1_2_0101410C
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0111010A	1_2_0111010A
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0106711A	1_2_0106711A
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010B9117	1_2_010B9117
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010FD111	1_2_010FD111
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010DF12D	1_2_010DF12D
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_01137133	1_2_01137133
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0105A124	1_2_0105A124
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0110E135	1_2_0110E135
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0104B122	1_2_0104B122
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010BF12C	1_2_010BF12C
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010D0120	1_2_010D0120
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010F313D	1_2_010F313D
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0102213D	1_2_0102213D
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0102F143	1_2_0102F143
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010E614D	1_2_010E614D
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010AC140	1_2_010AC140
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_011E2150	1_2_011E2150
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0106A152	1_2_0106A152
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_01032155	1_2_01032155
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_01117146	1_2_01117146
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_01042167	1_2_01042167
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0111F177	1_2_0111F177
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_01005168	1_2_01005168
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_01093162	1_2_01093162
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0105216B	1_2_0105216B
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0107A173	1_2_0107A173
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0106517A	1_2_0106517A
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0102117D	1_2_0102117D
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010E1185	1_2_010E1185
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010F5183	1_2_010F5183
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_01083185	1_2_01083185
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_01063188	1_2_01063188
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0110919E	1_2_0110919E
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0110A19E	1_2_0110A19E
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00FE806C	1_2_00FE806C
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00FF006B	1_2_00FF006B
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_01000197	1_2_01000197
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_01097191	1_2_01097191
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010511A0	1_2_010511A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0111A1BC	1_2_0111A1BC
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010641A8	1_2_010641A8
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00FF904F	1_2_00FF904F
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0103D1B4	1_2_0103D1B4
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010081C1	1_2_010081C1
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010C81CE	1_2_010C81CE
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010371CC	1_2_010371CC
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0100A1D5	1_2_0100A1D5
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0102D1D9	1_2_0102D1D9
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010891E8	1_2_010891E8
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010251E7	1_2_010251E7
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0108F1E0	1_2_0108F1E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0101D1F9	1_2_0101D1F9
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010551FA	1_2_010551FA
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0112C012	1_2_0112C012
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0109C00C	1_2_0109C00C
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0102000A	1_2_0102000A
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0105200D	1_2_0105200D
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010E8001	1_2_010E8001
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010DE01C	1_2_010DE01C
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0108601B	1_2_0108601B
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0102502E	1_2_0102502E
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0109E024	1_2_0109E024
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_01116028	1_2_01116028
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00FFE1C5	1_2_00FFE1C5
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010A2030	1_2_010A2030
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_01056039	1_2_01056039
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_01058056	1_2_01058056
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010A9052	1_2_010A9052
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0110D048	1_2_0110D048
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0110104F	1_2_0110104F
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010C406E	1_2_010C406E
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0105E066	1_2_0105E066
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0106E068	1_2_0106E068
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0109B066	1_2_0109B066
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010BB07F	1_2_010BB07F
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010D2071	1_2_010D2071
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0101A089	1_2_0101A089
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0102308A	1_2_0102308A
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0103008E	1_2_0103008E
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0102E08D	1_2_0102E08D
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_01138082	1_2_01138082
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00FF716D	1_2_00FF716D
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_01122087	1_2_01122087
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010310A7	1_2_010310A7
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010E00A9	1_2_010E00A9
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00FED157	1_2_00FED157
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010DA0A7	1_2_010DA0A7
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0107B0AC	1_2_0107B0AC
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010170AF	1_2_010170AF
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010AF0BA	1_2_010AF0BA
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010C60BF	1_2_010C60BF
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010C90B9	1_2_010C90B9
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_011060A5	1_2_011060A5
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0108B0C8	1_2_0108B0C8
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0102A0C0	1_2_0102A0C0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00FEC13B	1_2_00FEC13B
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010680C1	1_2_010680C1
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010980CE	1_2_010980CE
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00FF8137	1_2_00FF8137
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010F10C5	1_2_010F10C5
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010090CB	1_2_010090CB
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010540CB	1_2_010540CB
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010750D6	1_2_010750D6
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010EB0DB	1_2_010EB0DB
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010810DF	1_2_010810DF
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0108A0D0	1_2_0108A0D0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010D30D5	1_2_010D30D5
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010060DD	1_2_010060DD
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_011250CC	1_2_011250CC
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010790D8	1_2_010790D8
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00FEB119	1_2_00FEB119
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_011300FA	1_2_011300FA
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0101C0EA	1_2_0101C0EA
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0103B0E8	1_2_0103B0E8
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010D80E6	1_2_010D80E6
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010AA0E4	1_2_010AA0E4
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00FEF108	1_2_00FEF108
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010EA0F7	1_2_010EA0F7
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010340FF	1_2_010340FF
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010A8309	1_2_010A8309
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010EE306	1_2_010EE306
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010B2302	1_2_010B2302
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_01131318	1_2_01131318
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010E6301	1_2_010E6301
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_01062312	1_2_01062312
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_01090312	1_2_01090312
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_01151308	1_2_01151308
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010E4313	1_2_010E4313
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0106F319	1_2_0106F319
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010B432A	1_2_010B432A
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0113D331	1_2_0113D331
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0102B329	1_2_0102B329
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0110333C	1_2_0110333C
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_01001332	1_2_01001332
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0113A328	1_2_0113A328
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0108034D	1_2_0108034D
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_01058350	1_2_01058350
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0107B352	1_2_0107B352
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_01039354	1_2_01039354
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_01008359	1_2_01008359
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0104D35D	1_2_0104D35D
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0100235E	1_2_0100235E
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0109136B	1_2_0109136B
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0107F362	1_2_0107F362
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0112137A	1_2_0112137A
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010E7367	1_2_010E7367
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0105E36A	1_2_0105E36A
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0104937B	1_2_0104937B
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0105C383	1_2_0105C383
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00FF8278	1_2_00FF8278
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010FF382	1_2_010FF382
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010433A4	1_2_010433A4
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010D93AF	1_2_010D93AF
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010FB3A4	1_2_010FB3A4
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0110E3BF	1_2_0110E3BF
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0103A3B7	1_2_0103A3B7
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010143B7	1_2_010143B7
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00FEE249	1_2_00FEE249
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_011343A9	1_2_011343A9
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0103E3B8	1_2_0103E3B8
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010203BF	1_2_010203BF
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010423C7	1_2_010423C7
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010CE3CA	1_2_010CE3CA
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010F93C7	1_2_010F93C7
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0110A3C6	1_2_0110A3C6
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_011003C9	1_2_011003C9
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010363D8	1_2_010363D8
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010DE3D0	1_2_010DE3D0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0110D3CD	1_2_0110D3CD
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0109C3E8	1_2_0109C3E8
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010003E2	1_2_010003E2
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010243E5	1_2_010243E5
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0100B3EB	1_2_0100B3EB
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010AD3E4	1_2_010AD3E4
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010863F1	1_2_010863F1
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0112A216	1_2_0112A216
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0100C205	1_2_0100C205
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0100720A	1_2_0100720A
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_01087204	1_2_01087204
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0111921D	1_2_0111921D
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0100320F	1_2_0100320F
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_01069209	1_2_01069209
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_01009211	1_2_01009211
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010A521B	1_2_010A521B
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0109921B	1_2_0109921B
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_01104202	1_2_01104202
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0111B208	1_2_0111B208
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0113920A	1_2_0113920A
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0112B209	1_2_0112B209
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0104E225	1_2_0104E225
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0107822D	1_2_0107822D
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00FEA3D1	1_2_00FEA3D1
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010C1234	1_2_010C1234
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0103A23A	1_2_0103A23A
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0101E23D	1_2_0101E23D
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_01071238	1_2_01071238
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_01140253	1_2_01140253
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0110F25C	1_2_0110F25C
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010B6257	1_2_010B6257
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010FE251	1_2_010FE251
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_01027262	1_2_01027262
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_01066267	1_2_01066267
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0106C260	1_2_0106C260
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010E9268	1_2_010E9268
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0104326D	1_2_0104326D
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_01085266	1_2_01085266
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0102626D	1_2_0102626D
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0107C275	1_2_0107C275
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010BD272	1_2_010BD272
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010B8274	1_2_010B8274
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_01072282	1_2_01072282
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010A328F	1_2_010A328F
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010A728D	1_2_010A728D
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0104728D	1_2_0104728D
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0111629B	1_2_0111629B
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0104F28F	1_2_0104F28F
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00FFA36D	1_2_00FFA36D
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010E229A	1_2_010E229A
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010F1299	1_2_010F1299
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00FF3367	1_2_00FF3367
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0113F28A	1_2_0113F28A
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00FFB35B	1_2_00FFB35B
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00FF634E	1_2_00FF634E
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_011232A0	1_2_011232A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00FF4349	1_2_00FF4349
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010BA2BC	1_2_010BA2BC
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0103D2BC	1_2_0103D2BC
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010422C1	1_2_010422C1
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010922C5	1_2_010922C5
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0100E2CD	1_2_0100E2CD
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010452D1	1_2_010452D1
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_011202CA	1_2_011202CA
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0111E2CE	1_2_0111E2CE
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_011272E6	1_2_011272E6
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_011012E6	1_2_011012E6
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010882F4	1_2_010882F4
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010A2501	1_2_010A2501
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010F8501	1_2_010F8501
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0110451E	1_2_0110451E
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010F751F	1_2_010F751F
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0107E514	1_2_0107E514
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_01096510	1_2_01096510
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0101251B	1_2_0101251B
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_01028519	1_2_01028519
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00FFC4E3	1_2_00FFC4E3
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00FEC4DA	1_2_00FEC4DA
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0112A536	1_2_0112A536
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010D4526	1_2_010D4526
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_01067528	1_2_01067528
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_01061536	1_2_01061536
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0108653C	1_2_0108653C
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_01113525	1_2_01113525
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0111F527	1_2_0111F527
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0105F532	1_2_0105F532
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0110D52C	1_2_0110D52C
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010A0548	1_2_010A0548
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0101C542	1_2_0101C542
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0100E554	1_2_0100E554
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_01034556	1_2_01034556
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0107955E	1_2_0107955E
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_01082552	1_2_01082552
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00FF14A1	1_2_00FF14A1
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0101B55F	1_2_0101B55F
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_01085568	1_2_01085568
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0100A563	1_2_0100A563
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00FF749A	1_2_00FF749A
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010D656A	1_2_010D656A
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010FD563	1_2_010FD563
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0111A57D	1_2_0111A57D
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0112B562	1_2_0112B562
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_01066571	1_2_01066571
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010C6576	1_2_010C6576
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0112F56F	1_2_0112F56F
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010C058E	1_2_010C058E
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0110B596	1_2_0110B596
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0100758C	1_2_0100758C
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_01137588	1_2_01137588
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010CF5AD	1_2_010CF5AD
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010035A2	1_2_010035A2
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010325A8	1_2_010325A8
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0114C5A0	1_2_0114C5A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0114A5A2	1_2_0114A5A2
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_011365A5	1_2_011365A5
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0102E5B5	1_2_0102E5B5
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0106F5CC	1_2_0106F5CC
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_011275DC	1_2_011275DC
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010735D5	1_2_010735D5
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010B95D9	1_2_010B95D9
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010945DD	1_2_010945DD
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0106B5D8	1_2_0106B5D8
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00FE8421	1_2_00FE8421
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010FA5EE	1_2_010FA5EE
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00FEB41D	1_2_00FEB41D
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010B05E0	1_2_010B05E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0102F5ED	1_2_0102F5ED
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010D05FF	1_2_010D05FF
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_011335E7	1_2_011335E7
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0109C5F1	1_2_0109C5F1
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0101E5F8	1_2_0101E5F8
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_01108413	1_2_01108413
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0103C413	1_2_0103C413
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00FFC5EA	1_2_00FFC5EA
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0112440C	1_2_0112440C
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00FE75D4	1_2_00FE75D4
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010DC423	1_2_010DC423
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0108D43A	1_2_0108D43A
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_01135421	1_2_01135421
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_01088434	1_2_01088434
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0113345D	1_2_0113345D
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0107C456	1_2_0107C456
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_01101442	1_2_01101442
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00FE65A5	1_2_00FE65A5
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010E8455	1_2_010E8455
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00FFE59B	1_2_00FFE59B
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0109B46D	1_2_0109B46D
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0112847A	1_2_0112847A
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0103046F	1_2_0103046F
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010B7467	1_2_010B7467
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010F2460	1_2_010F2460
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_01054474	1_2_01054474
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010AE47B	1_2_010AE47B
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010C5478	1_2_010C5478
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010DB470	1_2_010DB470
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010D2487	1_2_010D2487
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_01005491	1_2_01005491
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0108749D	1_2_0108749D
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_01129485	1_2_01129485
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010E5492	1_2_010E5492
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0112248E	1_2_0112248E
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0106E4A3	1_2_0106E4A3
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_011384B9	1_2_011384B9
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0104B4A8	1_2_0104B4A8
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010C04A2	1_2_010C04A2
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010184AE	1_2_010184AE
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010A14A5	1_2_010A14A5
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010E34B8	1_2_010E34B8
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010154BD	1_2_010154BD
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010224BE	1_2_010224BE
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0112C4AC	1_2_0112C4AC
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010044C1	1_2_010044C1
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0113E4D7	1_2_0113E4D7
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_011144DB	1_2_011144DB
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010BB4C6	1_2_010BB4C6
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010814DB	1_2_010814DB
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_011454CC	1_2_011454CC
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010934E9	1_2_010934E9
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010354E6	1_2_010354E6
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0105B4ED	1_2_0105B4ED
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0103B4F1	1_2_0103B4F1
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010E44FC	1_2_010E44FC
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010314F7	1_2_010314F7
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010684F0	1_2_010684F0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010C870C	1_2_010C870C
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_01046705	1_2_01046705
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_01095706	1_2_01095706
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_01007719	1_2_01007719
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010B872F	1_2_010B872F
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010C573E	1_2_010C573E
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_01002735	1_2_01002735
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010A7735	1_2_010A7735
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010E774B	1_2_010E774B
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010ED74B	1_2_010ED74B
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0106174D	1_2_0106174D
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010DD746	1_2_010DD746
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010B575A	1_2_010B575A
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010E9755	1_2_010E9755
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0112D74F	1_2_0112D74F
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0103D75D	1_2_0103D75D
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0113B77C	1_2_0113B77C
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_01039776	1_2_01039776
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010D7775	1_2_010D7775
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_01132797	1_2_01132797
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_01080785	1_2_01080785
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0105578B	1_2_0105578B
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010EE780	1_2_010EE780
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0104C78B	1_2_0104C78B
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_01126782	1_2_01126782
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0105D79E	1_2_0105D79E
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010CE793	1_2_010CE793
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010B67A9	1_2_010B67A9
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0104F7A0	1_2_0104F7A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010137B0	1_2_010137B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010DE7BF	1_2_010DE7BF
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0109B7BA	1_2_0109B7BA
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010D17CB	1_2_010D17CB
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010C97C5	1_2_010C97C5
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010457CB	1_2_010457CB
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0108E7D2	1_2_0108E7D2
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_011357CD	1_2_011357CD
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010887D7	1_2_010887D7
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010257E2	1_2_010257E2
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0109D7EC	1_2_0109D7EC
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_011217F5	1_2_011217F5
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0113D7F8	1_2_0113D7F8
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0114F7FB	1_2_0114F7FB
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010377F7	1_2_010377F7
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010F17F9	1_2_010F17F9
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010AD7F5	1_2_010AD7F5
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_01125610	1_2_01125610
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0104D600	1_2_0104D600
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010AF603	1_2_010AF603
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_01102605	1_2_01102605
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_01033615	1_2_01033615
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0110F607	1_2_0110F607
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0102161C	1_2_0102161C
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010CC612	1_2_010CC612
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_01051627	1_2_01051627
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010A162D	1_2_010A162D
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0104162E	1_2_0104162E
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010E1620	1_2_010E1620
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0108F627	1_2_0108F627
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_01139621	1_2_01139621
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_01049632	1_2_01049632
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00FF57C6	1_2_00FF57C6
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_01017638	1_2_01017638
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0100963D	1_2_0100963D
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_01107657	1_2_01107657
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0111B65C	1_2_0111B65C
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_01076656	1_2_01076656
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010C765A	1_2_010C765A
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010FC658	1_2_010FC658
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010B1653	1_2_010B1653
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_01060658	1_2_01060658
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0107A658	1_2_0107A658
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00FF7798	1_2_00FF7798
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010F7666	1_2_010F7666
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0111967C	1_2_0111967C
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0111E67E	1_2_0111E67E
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010F167E	1_2_010F167E
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_01008679	1_2_01008679
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0108A671	1_2_0108A671
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0106967A	1_2_0106967A
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_01078678	1_2_01078678
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_01097676	1_2_01097676
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00FF1773	1_2_00FF1773
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0102D68F	1_2_0102D68F
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010D869A	1_2_010D869A
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010C16A4	1_2_010C16A4
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00FEB752	1_2_00FEB752
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010F56A3	1_2_010F56A3
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_011116BD	1_2_011116BD
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_011296A5	1_2_011296A5
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010A36B0	1_2_010A36B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0111A6D0	1_2_0111A6D0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00FFA73A	1_2_00FFA73A
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010426CC	1_2_010426CC
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010F36C7	1_2_010F36C7
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010596CE	1_2_010596CE
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_011006DE	1_2_011006DE
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010746D4	1_2_010746D4
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0105E6D0	1_2_0105E6D0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010586D3	1_2_010586D3
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010F96D8	1_2_010F96D8
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010846EF	1_2_010846EF
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010AA6E1	1_2_010AA6E1
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0104E6E9	1_2_0104E6E9
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00FFE70C	1_2_00FFE70C
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010D36F8	1_2_010D36F8
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0111C6E7	1_2_0111C6E7
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010566FC	1_2_010566FC
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010AE90A	1_2_010AE90A
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010B990F	1_2_010B990F
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0104890D	1_2_0104890D
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010F6901	1_2_010F6901
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_01120904	1_2_01120904
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010E4919	1_2_010E4919
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_01106907	1_2_01106907
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0105F918	1_2_0105F918
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0100B92C	1_2_0100B92C
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0102892F	1_2_0102892F
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_01057935	1_2_01057935
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010AC93F	1_2_010AC93F
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0113C92A	1_2_0113C92A
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_01068939	1_2_01068939
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0102E947	1_2_0102E947
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0105A94B	1_2_0105A94B
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0110D943	1_2_0110D943
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_01135945	1_2_01135945
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00FEA8A5	1_2_00FEA8A5
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0107995C	1_2_0107995C
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0112494F	1_2_0112494F
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0101A95E	1_2_0101A95E
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010D196D	1_2_010D196D
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0103B962	1_2_0103B962
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010C796D	1_2_010C796D
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0103E961	1_2_0103E961
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00FE5899	1_2_00FE5899
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010FD966	1_2_010FD966
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0101096E	1_2_0101096E
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_01029972	1_2_01029972
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0102A97D	1_2_0102A97D
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0111D993	1_2_0111D993
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0101698F	1_2_0101698F
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0110F99E	1_2_0110F99E
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010FF997	1_2_010FF997
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0111998B	1_2_0111998B
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010529A0	1_2_010529A0

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 011B67EE appears 35 times

Source: file.exe, 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000002.2313787936.00000000018BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe

Source: file.exe

Static PE information: Section: yiycfvys ZLIB complexity 0.9950387943897344

Source: classification engine

Classification label: mal100.evad.winEXE@1/1@0/0

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

Virustotal: Detection: 56%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: file.exe	String found in binary or memory: 3The file %s is missing. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior

Source: file.exe

Static file information: File size 1740800 > 1048576

Source: file.exe

Static PE information: Raw size of yiycfvys is bigger than: 0x100000 < 0x1a2e00

Source:

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 1.2.file.exe.fd0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;yiycfvys:EW;gwlxbero:EW;.taggant:EW; vs :ER;.rsrc:W;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1b553b should be: 0x1b8e7a

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: yiycfvys
Source: file.exe	Static PE information: section name: gwlxbero
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00FE1323 push esi; mov dword ptr [esp], ecx	1_2_00FE1F66
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00FE1323 push esi; mov dword ptr [esp], 3E5F2677h	1_2_00FE4875
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00FE1323 push ebx; mov dword ptr [esp], esi	1_2_00FE54F3
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00FDEC15 push ecx; mov dword ptr [esp], eax	1_2_00FDEC24
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00FDD0FC push ecx; mov dword ptr [esp], edx	1_2_00FDD100
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_01200122 push eax; mov dword ptr [esp], 7FBF5500h	1_2_0120014F
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_01200122 push 1B6C015Bh; mov dword ptr [esp], ebp	1_2_01200176
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_01200122 push 2464D55Fh; mov dword ptr [esp], edx	1_2_012001D6
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0120813F push 3F399ED5h; mov dword ptr [esp], edi	1_2_0120817D
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0118F129 push 74D24567h; mov dword ptr [esp], ebx	1_2_0118F19C
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00FE10BD push ecx; mov dword ptr [esp], 48BA7C7Dh	1_2_00FE3623
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0121716A push edi; mov dword ptr [esp], esi	1_2_012171D2
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00FDF0B1 push eax; mov dword ptr [esp], esi	1_2_00FDF305
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_011E2150 push 3656D911h; mov dword ptr [esp], esp	1_2_011E215C
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_011E2150 push esi; mov dword ptr [esp], 7CB6E4BFh	1_2_011E216B
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_011E2150 push eax; mov dword ptr [esp], 03BEDAD3h	1_2_011E21E3
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00FE20A8 push esi; mov dword ptr [esp], 4DDB87EAh	1_2_00FE3108
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00FE20A8 push ecx; mov dword ptr [esp], 5DDE36E5h	1_2_00FE311C
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00FDC08C push ecx; mov dword ptr [esp], eax	1_2_00FDC4E1
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00FE3087 push eax; mov dword ptr [esp], 6FFF5056h	1_2_00FE3088
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0122015F push 4824090Ah; mov dword ptr [esp], esp	1_2_01220195
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0122015F push 260A3FB6h; mov dword ptr [esp], ecx	1_2_012201B3
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_011FF1D5 push 5B088F53h; mov dword ptr [esp], ebx	1_2_011FF293
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010371CC push 5215CCBFh; mov dword ptr [esp], ecx	1_2_0103752C
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010371CC push edi; mov dword ptr [esp], ebp	1_2_010375BE
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010371CC push edx; mov dword ptr [esp], esp	1_2_010375C3
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010371CC push edx; mov dword ptr [esp], ebx	1_2_010375CC
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010371CC push edx; mov dword ptr [esp], eax	1_2_010375E7
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010371CC push ebp; mov dword ptr [esp], ecx	1_2_01037648
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010371CC push 71605630h; mov dword ptr [esp], edx	1_2_0103766C
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010371CC push ecx; mov dword ptr [esp], esi	1_2_01037681

Source: file.exe	Static PE information: section name: entropy: 7.802540159895336
Source: file.exe	Static PE information: section name: yiycfvys entropy: 7.953713263906357

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1159354 second address: 1159365 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96C0CA255Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115D93A second address: 115D94B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jns 00007F96C0E0BFD6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115DC0C second address: 115DC17 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007F96C0CA2556h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116199B second address: 11619C7 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F96C0E0BFD8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e jnp 00007F96C0E0BFE0h 0x00000014 jmp 00007F96C0E0BFDAh 0x00000019 mov eax, dword ptr [eax] 0x0000001b push eax 0x0000001c push edx 0x0000001d push ebx 0x0000001e jg 00007F96C0E0BFD6h 0x00000024 pop ebx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11619C7 second address: 11619E5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jl 00007F96C0CA2556h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 push esi 0x00000016 pop esi 0x00000017 jbe 00007F96C0CA2556h 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1161B5D second address: 1161B61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1161B61 second address: 1161B67 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1161B67 second address: 1161B94 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F96C0E0BFDEh 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F96C0E0BFE3h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1161B94 second address: 1161BDF instructions: 0x00000000 rdtsc 0x00000002 jl 00007F96C0CA256Dh 0x00000008 jmp 00007F96C0CA2567h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop eax 0x00000010 or dx, 0FA5h 0x00000015 lea ebx, dword ptr [ebp+12457886h] 0x0000001b mov ecx, dword ptr [ebp+122D2CABh] 0x00000021 xchg eax, ebx 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007F96C0CA2565h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1161BDF second address: 1161BE5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1161BE5 second address: 1161BE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1161C89 second address: 1161C9B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jl 00007F96C0E0BFD6h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1161C9B second address: 1161CA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1161CA1 second address: 1161CA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1161CA6 second address: 1161D23 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 jbe 00007F96C0CA2556h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e nop 0x0000000f push 00000000h 0x00000011 push edx 0x00000012 call 00007F96C0CA2558h 0x00000017 pop edx 0x00000018 mov dword ptr [esp+04h], edx 0x0000001c add dword ptr [esp+04h], 00000014h 0x00000024 inc edx 0x00000025 push edx 0x00000026 ret 0x00000027 pop edx 0x00000028 ret 0x00000029 or dx, DB0Fh 0x0000002e stc 0x0000002f push 00000000h 0x00000031 mov esi, 1F72D822h 0x00000036 call 00007F96C0CA2559h 0x0000003b pushad 0x0000003c jmp 00007F96C0CA2569h 0x00000041 pushad 0x00000042 jmp 00007F96C0CA2568h 0x00000047 pushad 0x00000048 popad 0x00000049 popad 0x0000004a popad 0x0000004b push eax 0x0000004c pushad 0x0000004d push edx 0x0000004e push eax 0x0000004f push edx 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1161D23 second address: 1161D46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jl 00007F96C0E0BFDCh 0x0000000b popad 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 pushad 0x00000011 jo 00007F96C0E0BFD8h 0x00000017 push ecx 0x00000018 pop ecx 0x00000019 push eax 0x0000001a push edx 0x0000001b push edi 0x0000001c pop edi 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1161D46 second address: 1161D4A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1161D4A second address: 1161DBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 jmp 00007F96C0E0BFE4h 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 jo 00007F96C0E0BFDEh 0x00000018 jg 00007F96C0E0BFD8h 0x0000001e pushad 0x0000001f popad 0x00000020 pop eax 0x00000021 add cl, 00000033h 0x00000024 push 00000003h 0x00000026 jmp 00007F96C0E0BFE4h 0x0000002b push 00000000h 0x0000002d and edi, 475E64F9h 0x00000033 push 00000003h 0x00000035 cmc 0x00000036 push A5BD6CA3h 0x0000003b push eax 0x0000003c push edx 0x0000003d jmp 00007F96C0E0BFE9h 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1161DBE second address: 1161E21 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F96C0CA2566h 0x00000008 jmp 00007F96C0CA255Bh 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 xor dword ptr [esp], 65BD6CA3h 0x00000017 jmp 00007F96C0CA2568h 0x0000001c lea ebx, dword ptr [ebp+1245788Fh] 0x00000022 mov dword ptr [ebp+122D1FE4h], ebx 0x00000028 xchg eax, ebx 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c pushad 0x0000002d popad 0x0000002e jmp 00007F96C0CA255Ah 0x00000033 popad 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1161E21 second address: 1161E46 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F96C0E0BFD8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 jmp 00007F96C0E0BFE2h 0x00000015 push eax 0x00000016 pop eax 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1161FCE second address: 1161FD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117F642 second address: 117F66B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96C0E0BFE7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jl 00007F96C0E0BFFDh 0x0000000f push eax 0x00000010 push edx 0x00000011 jg 00007F96C0E0BFD6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117F66B second address: 117F671 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117FA72 second address: 117FA76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117FA76 second address: 117FA8E instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F96C0CA2556h 0x00000008 jmp 00007F96C0CA255Eh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1180038 second address: 118003C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1180338 second address: 118033C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118033C second address: 1180340 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11805AB second address: 11805C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F96C0CA2562h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11805C1 second address: 11805DB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 jnp 00007F96C0E0BFD6h 0x0000000f push edx 0x00000010 pop edx 0x00000011 pushad 0x00000012 popad 0x00000013 jc 00007F96C0E0BFD6h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11805DB second address: 11805E2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11805E2 second address: 11805EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11752F2 second address: 1175311 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F96C0CA2566h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1175311 second address: 1175317 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1175317 second address: 117531B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117531B second address: 1175334 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96C0E0BFE1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1180884 second address: 118088A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1180F5C second address: 1180F70 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F96C0E0BFE0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1180F70 second address: 1180F92 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F96C0CA2568h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1180F92 second address: 1180FAA instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnp 00007F96C0E0BFEAh 0x0000000e push eax 0x0000000f push edx 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 jno 00007F96C0E0BFD6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1180FAA second address: 1180FAE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118518B second address: 1185190 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1185190 second address: 11851A8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F96C0CA2561h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118742B second address: 118742F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11885A0 second address: 11885A6 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11885A6 second address: 11885BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F96C0E0BFE3h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118BD05 second address: 118BD09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114A0B9 second address: 114A0BE instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114A0BE second address: 114A0C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114A0C4 second address: 114A101 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jmp 00007F96C0E0BFE8h 0x0000000f push edi 0x00000010 pop edi 0x00000011 push eax 0x00000012 pop eax 0x00000013 popad 0x00000014 jno 00007F96C0E0BFE6h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118E8B0 second address: 118E8B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118E8B4 second address: 118E8C6 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007F96C0E0BFDCh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118EA4D second address: 118EA6C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96C0CA255Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b js 00007F96C0CA2556h 0x00000011 jnp 00007F96C0CA2556h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118EA6C second address: 118EA90 instructions: 0x00000000 rdtsc 0x00000002 js 00007F96C0E0BFD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F96C0E0BFE6h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118EA90 second address: 118EA94 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118ED38 second address: 118ED49 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96C0E0BFDDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118ED49 second address: 118ED84 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007F96C0CA2556h 0x00000009 jnl 00007F96C0CA2556h 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 popad 0x00000012 jmp 00007F96C0CA2566h 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push eax 0x0000001a push edx 0x0000001b push esi 0x0000001c jmp 00007F96C0CA255Dh 0x00000021 pop esi 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118EECA second address: 118EEF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F96C0E0BFD6h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d je 00007F96C0E0BFF1h 0x00000013 jmp 00007F96C0E0BFE5h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1190D0B second address: 1190D39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 mov eax, dword ptr [eax] 0x0000000a jmp 00007F96C0CA2567h 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 jg 00007F96C0CA2556h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11910EA second address: 11910F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 ja 00007F96C0E0BFD6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11910F6 second address: 11910FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1191298 second address: 119129E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119129E second address: 11912A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11912A2 second address: 11912A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1191C29 second address: 1191C3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 je 00007F96C0CA255Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1191D99 second address: 1191D9D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1191E8C second address: 1191E92 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1191F23 second address: 1191F29 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1196127 second address: 1196137 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96C0CA255Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1196137 second address: 119613C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1197525 second address: 119752C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11982DF second address: 11982E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11982E3 second address: 11982F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11982F2 second address: 11982F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1150E8C second address: 1150EA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jl 00007F96C0CA2558h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1150EA0 second address: 1150EA6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119A184 second address: 119A18A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119BEC1 second address: 119BED3 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jbe 00007F96C0E0BFD6h 0x00000009 pop edx 0x0000000a jo 00007F96C0E0BFDCh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119ED9A second address: 119EE12 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 mov edi, 0F29E320h 0x0000000d push 00000000h 0x0000000f push 00000000h 0x00000011 push eax 0x00000012 call 00007F96C0CA2558h 0x00000017 pop eax 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c add dword ptr [esp+04h], 0000001Ah 0x00000024 inc eax 0x00000025 push eax 0x00000026 ret 0x00000027 pop eax 0x00000028 ret 0x00000029 add edi, 7F75F285h 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push eax 0x00000034 call 00007F96C0CA2558h 0x00000039 pop eax 0x0000003a mov dword ptr [esp+04h], eax 0x0000003e add dword ptr [esp+04h], 00000016h 0x00000046 inc eax 0x00000047 push eax 0x00000048 ret 0x00000049 pop eax 0x0000004a ret 0x0000004b sub dword ptr [ebp+122D1BB2h], edi 0x00000051 xor dword ptr [ebp+122D3873h], eax 0x00000057 xchg eax, esi 0x00000058 jo 00007F96C0CA255Eh 0x0000005e jp 00007F96C0CA2558h 0x00000064 push eax 0x00000065 push eax 0x00000066 push edx 0x00000067 push edi 0x00000068 push eax 0x00000069 push edx 0x0000006a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119EE12 second address: 119EE17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119FCD7 second address: 119FCF4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96C0CA2569h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119FCF4 second address: 119FD87 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F96C0E0BFDAh 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F96C0E0BFE0h 0x00000011 nop 0x00000012 call 00007F96C0E0BFDDh 0x00000017 movsx edi, bx 0x0000001a pop edi 0x0000001b push 00000000h 0x0000001d push 00000000h 0x0000001f push esi 0x00000020 call 00007F96C0E0BFD8h 0x00000025 pop esi 0x00000026 mov dword ptr [esp+04h], esi 0x0000002a add dword ptr [esp+04h], 00000015h 0x00000032 inc esi 0x00000033 push esi 0x00000034 ret 0x00000035 pop esi 0x00000036 ret 0x00000037 mov dword ptr [ebp+12457CF4h], ebx 0x0000003d push 00000000h 0x0000003f push 00000000h 0x00000041 push esi 0x00000042 call 00007F96C0E0BFD8h 0x00000047 pop esi 0x00000048 mov dword ptr [esp+04h], esi 0x0000004c add dword ptr [esp+04h], 00000019h 0x00000054 inc esi 0x00000055 push esi 0x00000056 ret 0x00000057 pop esi 0x00000058 ret 0x00000059 mov bx, di 0x0000005c push eax 0x0000005d push eax 0x0000005e push edx 0x0000005f push ecx 0x00000060 jmp 00007F96C0E0BFE0h 0x00000065 pop ecx 0x00000066 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A0DE7 second address: 11A0E7B instructions: 0x00000000 rdtsc 0x00000002 jne 00007F96C0CA2558h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push ecx 0x0000000e call 00007F96C0CA2558h 0x00000013 pop ecx 0x00000014 mov dword ptr [esp+04h], ecx 0x00000018 add dword ptr [esp+04h], 0000001Dh 0x00000020 inc ecx 0x00000021 push ecx 0x00000022 ret 0x00000023 pop ecx 0x00000024 ret 0x00000025 add dword ptr [ebp+122D39AAh], eax 0x0000002b mov edi, dword ptr [ebp+122D2F45h] 0x00000031 push 00000000h 0x00000033 push 00000000h 0x00000035 push edx 0x00000036 call 00007F96C0CA2558h 0x0000003b pop edx 0x0000003c mov dword ptr [esp+04h], edx 0x00000040 add dword ptr [esp+04h], 00000019h 0x00000048 inc edx 0x00000049 push edx 0x0000004a ret 0x0000004b pop edx 0x0000004c ret 0x0000004d mov dword ptr [ebp+12476A5Dh], edi 0x00000053 push 00000000h 0x00000055 mov edi, dword ptr [ebp+124680E4h] 0x0000005b xchg eax, esi 0x0000005c ja 00007F96C0CA256Dh 0x00000062 push eax 0x00000063 push eax 0x00000064 push edx 0x00000065 push eax 0x00000066 push edx 0x00000067 pushad 0x00000068 popad 0x00000069 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A0E7B second address: 11A0E85 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F96C0E0BFD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A1DF8 second address: 11A1DFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A0F46 second address: 11A0F4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A1DFC second address: 11A1E00 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A0F4D second address: 11A0F6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 pushad 0x0000000a jmp 00007F96C0E0BFE2h 0x0000000f push esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A1E00 second address: 11A1E06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A0F6C second address: 11A0FFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 nop 0x00000007 clc 0x00000008 push dword ptr fs:[00000000h] 0x0000000f mov edi, dword ptr [ebp+122D34CCh] 0x00000015 mov dword ptr fs:[00000000h], esp 0x0000001c jne 00007F96C0E0BFDBh 0x00000022 mov di, ax 0x00000025 mov eax, dword ptr [ebp+122D0329h] 0x0000002b push 00000000h 0x0000002d push esi 0x0000002e call 00007F96C0E0BFD8h 0x00000033 pop esi 0x00000034 mov dword ptr [esp+04h], esi 0x00000038 add dword ptr [esp+04h], 0000001Ah 0x00000040 inc esi 0x00000041 push esi 0x00000042 ret 0x00000043 pop esi 0x00000044 ret 0x00000045 push FFFFFFFFh 0x00000047 push 00000000h 0x00000049 push edx 0x0000004a call 00007F96C0E0BFD8h 0x0000004f pop edx 0x00000050 mov dword ptr [esp+04h], edx 0x00000054 add dword ptr [esp+04h], 0000001Ah 0x0000005c inc edx 0x0000005d push edx 0x0000005e ret 0x0000005f pop edx 0x00000060 ret 0x00000061 nop 0x00000062 js 00007F96C0E0BFDEh 0x00000068 jg 00007F96C0E0BFD8h 0x0000006e push eax 0x0000006f push eax 0x00000070 push edx 0x00000071 je 00007F96C0E0BFD8h 0x00000077 pushad 0x00000078 popad 0x00000079 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A1E06 second address: 11A1E14 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F96C0CA255Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A1E14 second address: 11A1E82 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push 00000000h 0x0000000d push ebx 0x0000000e call 00007F96C0E0BFD8h 0x00000013 pop ebx 0x00000014 mov dword ptr [esp+04h], ebx 0x00000018 add dword ptr [esp+04h], 00000019h 0x00000020 inc ebx 0x00000021 push ebx 0x00000022 ret 0x00000023 pop ebx 0x00000024 ret 0x00000025 jmp 00007F96C0E0BFDEh 0x0000002a pushad 0x0000002b stc 0x0000002c movsx eax, di 0x0000002f popad 0x00000030 push 00000000h 0x00000032 push 00000000h 0x00000034 push eax 0x00000035 call 00007F96C0E0BFD8h 0x0000003a pop eax 0x0000003b mov dword ptr [esp+04h], eax 0x0000003f add dword ptr [esp+04h], 0000001Ch 0x00000047 inc eax 0x00000048 push eax 0x00000049 ret 0x0000004a pop eax 0x0000004b ret 0x0000004c cmc 0x0000004d xchg eax, esi 0x0000004e push eax 0x0000004f push edx 0x00000050 push eax 0x00000051 push edx 0x00000052 push edi 0x00000053 pop edi 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A1E82 second address: 11A1E8C instructions: 0x00000000 rdtsc 0x00000002 jc 00007F96C0CA2556h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A508A second address: 11A5090 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A3083 second address: 11A308C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A5090 second address: 11A5095 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A5095 second address: 11A5122 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F96C0CA255Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d call 00007F96C0CA2563h 0x00000012 mov dword ptr [ebp+122D2969h], eax 0x00000018 pop ebx 0x00000019 push 00000000h 0x0000001b push 00000000h 0x0000001d push eax 0x0000001e call 00007F96C0CA2558h 0x00000023 pop eax 0x00000024 mov dword ptr [esp+04h], eax 0x00000028 add dword ptr [esp+04h], 0000001Bh 0x00000030 inc eax 0x00000031 push eax 0x00000032 ret 0x00000033 pop eax 0x00000034 ret 0x00000035 sub bx, 024Fh 0x0000003a push 00000000h 0x0000003c push 00000000h 0x0000003e push edi 0x0000003f call 00007F96C0CA2558h 0x00000044 pop edi 0x00000045 mov dword ptr [esp+04h], edi 0x00000049 add dword ptr [esp+04h], 0000001Ch 0x00000051 inc edi 0x00000052 push edi 0x00000053 ret 0x00000054 pop edi 0x00000055 ret 0x00000056 jl 00007F96C0CA2556h 0x0000005c xchg eax, esi 0x0000005d pushad 0x0000005e push eax 0x0000005f push edx 0x00000060 jnc 00007F96C0CA2556h 0x00000066 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A5122 second address: 11A513C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jng 00007F96C0E0BFD8h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f push eax 0x00000010 je 00007F96C0E0BFE0h 0x00000016 push eax 0x00000017 push edx 0x00000018 push ecx 0x00000019 pop ecx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A606D second address: 11A60DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 jno 00007F96C0CA2556h 0x0000000c pop eax 0x0000000d popad 0x0000000e mov dword ptr [esp], eax 0x00000011 cld 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push edi 0x00000017 call 00007F96C0CA2558h 0x0000001c pop edi 0x0000001d mov dword ptr [esp+04h], edi 0x00000021 add dword ptr [esp+04h], 00000019h 0x00000029 inc edi 0x0000002a push edi 0x0000002b ret 0x0000002c pop edi 0x0000002d ret 0x0000002e mov di, si 0x00000031 cld 0x00000032 mov edi, dword ptr [ebp+122D285Eh] 0x00000038 push 00000000h 0x0000003a push 00000000h 0x0000003c push edx 0x0000003d call 00007F96C0CA2558h 0x00000042 pop edx 0x00000043 mov dword ptr [esp+04h], edx 0x00000047 add dword ptr [esp+04h], 00000015h 0x0000004f inc edx 0x00000050 push edx 0x00000051 ret 0x00000052 pop edx 0x00000053 ret 0x00000054 xor ebx, 12A3567Ah 0x0000005a xchg eax, esi 0x0000005b push ecx 0x0000005c push eax 0x0000005d push edx 0x0000005e je 00007F96C0CA2556h 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A60DB second address: 11A60DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A5299 second address: 11A5351 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96C0CA2561h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push edx 0x00000010 call 00007F96C0CA2558h 0x00000015 pop edx 0x00000016 mov dword ptr [esp+04h], edx 0x0000001a add dword ptr [esp+04h], 00000015h 0x00000022 inc edx 0x00000023 push edx 0x00000024 ret 0x00000025 pop edx 0x00000026 ret 0x00000027 and bx, CB2Ah 0x0000002c push dword ptr fs:[00000000h] 0x00000033 push 00000000h 0x00000035 push esi 0x00000036 call 00007F96C0CA2558h 0x0000003b pop esi 0x0000003c mov dword ptr [esp+04h], esi 0x00000040 add dword ptr [esp+04h], 0000001Bh 0x00000048 inc esi 0x00000049 push esi 0x0000004a ret 0x0000004b pop esi 0x0000004c ret 0x0000004d jp 00007F96C0CA2565h 0x00000053 mov dword ptr fs:[00000000h], esp 0x0000005a mov dword ptr [ebp+122D2753h], esi 0x00000060 mov eax, dword ptr [ebp+122D0531h] 0x00000066 sub bh, FFFFFFF3h 0x00000069 push FFFFFFFFh 0x0000006b add dword ptr [ebp+124789C6h], esi 0x00000071 sub di, F68Ah 0x00000076 nop 0x00000077 push eax 0x00000078 push edx 0x00000079 jno 00007F96C0CA2568h 0x0000007f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A6239 second address: 11A623D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A910D second address: 11A9129 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96C0CA2568h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A9129 second address: 11A9130 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1141A3A second address: 1141A3F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1141A3F second address: 1141A50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push edx 0x0000000d pop edx 0x0000000e push edi 0x0000000f pop edi 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A981D second address: 11A9822 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A623D second address: 11A6246 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AB760 second address: 11AB7FF instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F96C0CA2556h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F96C0CA255Dh 0x0000000f popad 0x00000010 push eax 0x00000011 jo 00007F96C0CA2571h 0x00000017 pushad 0x00000018 pushad 0x00000019 popad 0x0000001a jmp 00007F96C0CA2567h 0x0000001f popad 0x00000020 nop 0x00000021 mov edi, dword ptr [ebp+122D2CA3h] 0x00000027 push 00000000h 0x00000029 push 00000000h 0x0000002b push esi 0x0000002c call 00007F96C0CA2558h 0x00000031 pop esi 0x00000032 mov dword ptr [esp+04h], esi 0x00000036 add dword ptr [esp+04h], 00000018h 0x0000003e inc esi 0x0000003f push esi 0x00000040 ret 0x00000041 pop esi 0x00000042 ret 0x00000043 mov dword ptr [ebp+122D39AFh], eax 0x00000049 push 00000000h 0x0000004b call 00007F96C0CA2569h 0x00000050 stc 0x00000051 pop ebx 0x00000052 xchg eax, esi 0x00000053 jno 00007F96C0CA2562h 0x00000059 push eax 0x0000005a pushad 0x0000005b push eax 0x0000005c push edx 0x0000005d push edi 0x0000005e pop edi 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AB7FF second address: 11AB803 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AB803 second address: 11AB811 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnp 00007F96C0CA2556h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ADD87 second address: 11ADD8B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AED3E second address: 11AED97 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96C0CA2562h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov di, 1400h 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push edi 0x00000015 call 00007F96C0CA2558h 0x0000001a pop edi 0x0000001b mov dword ptr [esp+04h], edi 0x0000001f add dword ptr [esp+04h], 0000001Ch 0x00000027 inc edi 0x00000028 push edi 0x00000029 ret 0x0000002a pop edi 0x0000002b ret 0x0000002c and di, EC34h 0x00000031 push 00000000h 0x00000033 mov dword ptr [ebp+122D2027h], ecx 0x00000039 xchg eax, esi 0x0000003a push eax 0x0000003b push edx 0x0000003c pushad 0x0000003d pushad 0x0000003e popad 0x0000003f push ecx 0x00000040 pop ecx 0x00000041 popad 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AED97 second address: 11AEDA1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F96C0E0BFD6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AA905 second address: 11AA911 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 js 00007F96C0CA2556h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AA9BA second address: 11AA9C4 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F96C0E0BFD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AFC39 second address: 11AFCA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 mov dword ptr [esp], eax 0x00000008 push 00000000h 0x0000000a push ebx 0x0000000b call 00007F96C0CA2558h 0x00000010 pop ebx 0x00000011 mov dword ptr [esp+04h], ebx 0x00000015 add dword ptr [esp+04h], 00000015h 0x0000001d inc ebx 0x0000001e push ebx 0x0000001f ret 0x00000020 pop ebx 0x00000021 ret 0x00000022 mov ebx, 16243526h 0x00000027 push 00000000h 0x00000029 push 00000000h 0x0000002b push edx 0x0000002c call 00007F96C0CA2558h 0x00000031 pop edx 0x00000032 mov dword ptr [esp+04h], edx 0x00000036 add dword ptr [esp+04h], 0000001Ah 0x0000003e inc edx 0x0000003f push edx 0x00000040 ret 0x00000041 pop edx 0x00000042 ret 0x00000043 jl 00007F96C0CA255Ch 0x00000049 jng 00007F96C0CA2556h 0x0000004f mov dword ptr [ebp+122D3302h], edi 0x00000055 push 00000000h 0x00000057 xchg eax, esi 0x00000058 push eax 0x00000059 push edx 0x0000005a push ebx 0x0000005b push eax 0x0000005c push edx 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AFCA1 second address: 11AFCA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ADF1C second address: 11ADF22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B0D6A second address: 11B0D82 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F96C0E0BFE4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AFE2F second address: 11AFE51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F96C0CA2569h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B30AD second address: 11B30B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B30B3 second address: 11B30B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C0447 second address: 11C044D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C8FF1 second address: 11C8FF6 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C91B6 second address: 11C91BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C9287 second address: 11C92C7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96C0CA2562h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jnc 00007F96C0CA255Ah 0x00000013 mov eax, dword ptr [eax] 0x00000015 jmp 00007F96C0CA255Ah 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 pushad 0x00000022 popad 0x00000023 jp 00007F96C0CA2556h 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CDE94 second address: 11CDE9A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CDE9A second address: 11CDED1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96C0CA2569h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F96C0CA2568h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CCCEA second address: 11CCCFF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F96C0E0BFE0h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CD2CE second address: 11CD306 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F96C0CA2556h 0x0000000a jbe 00007F96C0CA2556h 0x00000010 popad 0x00000011 pushad 0x00000012 jmp 00007F96C0CA2560h 0x00000017 jmp 00007F96C0CA2564h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CD306 second address: 11CD30B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CD30B second address: 11CD315 instructions: 0x00000000 rdtsc 0x00000002 js 00007F96C0CA255Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CD315 second address: 11CD32C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a jmp 00007F96C0E0BFDDh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CD32C second address: 11CD330 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CD330 second address: 11CD336 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CD470 second address: 11CD47A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F96C0CA2556h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CD86B second address: 11CD875 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 push edx 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CDAF5 second address: 11CDAF9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CDD33 second address: 11CDD37 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D209E second address: 11D20AC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F96C0CA2558h 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D20AC second address: 11D20B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D2351 second address: 11D2355 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D2355 second address: 11D2384 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96C0E0BFE0h 0x00000007 je 00007F96C0E0BFD6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F96C0E0BFDDh 0x00000016 jc 00007F96C0E0BFD6h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D2B41 second address: 11D2B63 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96C0CA255Bh 0x00000007 pushad 0x00000008 ja 00007F96C0CA2556h 0x0000000e jmp 00007F96C0CA255Ch 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D2E58 second address: 11D2E7F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96C0E0BFE8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a jg 00007F96C0E0BFE6h 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D2E7F second address: 11D2E83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D64A5 second address: 11D64B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007F96C0E0BFDEh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119C85F second address: 119C869 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F96C0CA2556h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119C869 second address: 119C87B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push edi 0x0000000b push edx 0x0000000c pop edx 0x0000000d pop edi 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119C87B second address: 119C87F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119C87F second address: 11752F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 call dword ptr [ebp+122D1D5Fh] 0x0000000e pushad 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119CE30 second address: 119CEB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 xor dword ptr [esp], 6F570D8Ah 0x0000000c push 00000000h 0x0000000e push edi 0x0000000f call 00007F96C0CA2558h 0x00000014 pop edi 0x00000015 mov dword ptr [esp+04h], edi 0x00000019 add dword ptr [esp+04h], 00000014h 0x00000021 inc edi 0x00000022 push edi 0x00000023 ret 0x00000024 pop edi 0x00000025 ret 0x00000026 jmp 00007F96C0CA255Ah 0x0000002b call 00007F96C0CA2559h 0x00000030 push esi 0x00000031 push esi 0x00000032 jmp 00007F96C0CA255Dh 0x00000037 pop esi 0x00000038 pop esi 0x00000039 push eax 0x0000003a jns 00007F96C0CA255Eh 0x00000040 mov eax, dword ptr [esp+04h] 0x00000044 push edx 0x00000045 pushad 0x00000046 push eax 0x00000047 pop eax 0x00000048 pushad 0x00000049 popad 0x0000004a popad 0x0000004b pop edx 0x0000004c mov eax, dword ptr [eax] 0x0000004e push eax 0x0000004f push edx 0x00000050 jng 00007F96C0CA2565h 0x00000056 jmp 00007F96C0CA255Fh 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119CEB0 second address: 119CEB5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119CF73 second address: 119CF78 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119D0DC second address: 119D0E2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119D0E2 second address: 119D0F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F96C0CA2560h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119D674 second address: 119D6F7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 jl 00007F96C0E0BFDCh 0x0000000f jo 00007F96C0E0BFD6h 0x00000015 jc 00007F96C0E0BFECh 0x0000001b jmp 00007F96C0E0BFE6h 0x00000020 popad 0x00000021 nop 0x00000022 push 00000000h 0x00000024 push ebp 0x00000025 call 00007F96C0E0BFD8h 0x0000002a pop ebp 0x0000002b mov dword ptr [esp+04h], ebp 0x0000002f add dword ptr [esp+04h], 00000019h 0x00000037 inc ebp 0x00000038 push ebp 0x00000039 ret 0x0000003a pop ebp 0x0000003b ret 0x0000003c mov dx, ax 0x0000003f push 0000001Eh 0x00000041 push 00000000h 0x00000043 push esi 0x00000044 call 00007F96C0E0BFD8h 0x00000049 pop esi 0x0000004a mov dword ptr [esp+04h], esi 0x0000004e add dword ptr [esp+04h], 00000016h 0x00000056 inc esi 0x00000057 push esi 0x00000058 ret 0x00000059 pop esi 0x0000005a ret 0x0000005b xor dword ptr [ebp+122D1C62h], esi 0x00000061 nop 0x00000062 push esi 0x00000063 push eax 0x00000064 push edx 0x00000065 push esi 0x00000066 pop esi 0x00000067 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119D6F7 second address: 119D704 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119D704 second address: 119D708 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119D969 second address: 119D96D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119D96D second address: 119D9B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jno 00007F96C0E0BFD8h 0x0000000c popad 0x0000000d push eax 0x0000000e jbe 00007F96C0E0BFDAh 0x00000014 push edx 0x00000015 push edx 0x00000016 pop edx 0x00000017 pop edx 0x00000018 mov eax, dword ptr [esp+04h] 0x0000001c push ecx 0x0000001d pushad 0x0000001e push ebx 0x0000001f pop ebx 0x00000020 push ebx 0x00000021 pop ebx 0x00000022 popad 0x00000023 pop ecx 0x00000024 mov eax, dword ptr [eax] 0x00000026 jne 00007F96C0E0BFE2h 0x0000002c mov dword ptr [esp+04h], eax 0x00000030 push eax 0x00000031 push edx 0x00000032 push eax 0x00000033 push edx 0x00000034 jbe 00007F96C0E0BFD6h 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119D9B5 second address: 119D9BB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119DA4F second address: 119DA53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119DA53 second address: 119DA64 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96C0CA255Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119DA64 second address: 119DAB9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96C0E0BFE2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c and edx, 2DE8128Eh 0x00000012 lea eax, dword ptr [ebp+12492602h] 0x00000018 nop 0x00000019 pushad 0x0000001a pushad 0x0000001b jmp 00007F96C0E0BFE8h 0x00000020 push esi 0x00000021 pop esi 0x00000022 popad 0x00000023 je 00007F96C0E0BFD8h 0x00000029 pushad 0x0000002a popad 0x0000002b popad 0x0000002c push eax 0x0000002d push eax 0x0000002e push edx 0x0000002f pushad 0x00000030 push edx 0x00000031 pop edx 0x00000032 pushad 0x00000033 popad 0x00000034 popad 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119DAB9 second address: 119DABE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119DABE second address: 1175EA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 mov edx, dword ptr [ebp+122D1FF9h] 0x0000000e lea eax, dword ptr [ebp+124925BEh] 0x00000014 push 00000000h 0x00000016 push ecx 0x00000017 call 00007F96C0E0BFD8h 0x0000001c pop ecx 0x0000001d mov dword ptr [esp+04h], ecx 0x00000021 add dword ptr [esp+04h], 0000001Ch 0x00000029 inc ecx 0x0000002a push ecx 0x0000002b ret 0x0000002c pop ecx 0x0000002d ret 0x0000002e push eax 0x0000002f push ebx 0x00000030 push edx 0x00000031 jl 00007F96C0E0BFD6h 0x00000037 pop edx 0x00000038 pop ebx 0x00000039 mov dword ptr [esp], eax 0x0000003c push 00000000h 0x0000003e push ebx 0x0000003f call 00007F96C0E0BFD8h 0x00000044 pop ebx 0x00000045 mov dword ptr [esp+04h], ebx 0x00000049 add dword ptr [esp+04h], 0000001Ah 0x00000051 inc ebx 0x00000052 push ebx 0x00000053 ret 0x00000054 pop ebx 0x00000055 ret 0x00000056 call dword ptr [ebp+122D1D59h] 0x0000005c jo 00007F96C0E0BFFDh 0x00000062 push eax 0x00000063 push edx 0x00000064 push eax 0x00000065 push edx 0x00000066 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1175EA9 second address: 1175EAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1175EAD second address: 1175EF1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F96C0E0BFE5h 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push edi 0x00000012 jbe 00007F96C0E0BFD6h 0x00000018 pushad 0x00000019 popad 0x0000001a pop edi 0x0000001b pushad 0x0000001c jmp 00007F96C0E0BFE6h 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1175EF1 second address: 1175EF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1175EF7 second address: 1175EFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1175EFC second address: 1175F01 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1175F01 second address: 1175F23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F96C0E0BFE0h 0x00000009 jmp 00007F96C0E0BFDAh 0x0000000e popad 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1175F23 second address: 1175F37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F96C0CA255Eh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DB42B second address: 11DB455 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96C0E0BFE2h 0x00000007 jnc 00007F96C0E0BFEAh 0x0000000d jmp 00007F96C0E0BFDEh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DBCAE second address: 11DBCB8 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F96C0CA2556h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E1A42 second address: 11E1A56 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96C0E0BFDCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E0406 second address: 11E0419 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push esi 0x00000006 jmp 00007F96C0CA255Bh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E0419 second address: 11E0429 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jo 00007F96C0E0BFD8h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E06DC second address: 11E06F2 instructions: 0x00000000 rdtsc 0x00000002 je 00007F96C0CA2556h 0x00000008 jnl 00007F96C0CA2556h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E06F2 second address: 11E06F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E0885 second address: 11E0889 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E0FD9 second address: 11E0FF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jne 00007F96C0E0BFE2h 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E18C5 second address: 11E18DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F96C0CA255Fh 0x00000009 js 00007F96C0CA2556h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E18DF second address: 11E18EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 js 00007F96C0E0BFD6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E18EB second address: 11E190B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96C0CA2568h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c pop edi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E7231 second address: 11E7245 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F96C0E0BFDCh 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E9C48 second address: 11E9C68 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F96C0CA2568h 0x00000008 jmp 00007F96C0CA2562h 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E9794 second address: 11E97A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007F96C0E0BFDBh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EE762 second address: 11EE776 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96C0CA255Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EE776 second address: 11EE79E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F96C0E0BFE9h 0x0000000e jl 00007F96C0E0BFD6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EE79E second address: 11EE7A8 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F96C0CA2556h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EE7A8 second address: 11EE7B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EE7B7 second address: 11EE7BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EE7BB second address: 11EE7DD instructions: 0x00000000 rdtsc 0x00000002 jno 00007F96C0E0BFD6h 0x00000008 jmp 00007F96C0E0BFE4h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EE7DD second address: 11EE7E3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EE7E3 second address: 11EE7ED instructions: 0x00000000 rdtsc 0x00000002 jng 00007F96C0E0BFDCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EE931 second address: 11EE935 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EE935 second address: 11EE93B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F05FD second address: 11F0616 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96C0CA2564h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F3400 second address: 11F3413 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F96C0E0BFDAh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F3413 second address: 11F3434 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F96C0CA2568h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F3434 second address: 11F3438 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F3438 second address: 11F3472 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 jno 00007F96C0CA2556h 0x0000000f jg 00007F96C0CA2556h 0x00000015 push eax 0x00000016 pop eax 0x00000017 popad 0x00000018 jmp 00007F96C0CA2563h 0x0000001d pushad 0x0000001e jmp 00007F96C0CA255Ch 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F307D second address: 11F3081 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F7418 second address: 11F741C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F741C second address: 11F7467 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jnp 00007F96C0E0BFD6h 0x00000009 jmp 00007F96C0E0BFE7h 0x0000000e pop eax 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F96C0E0BFE9h 0x00000018 jmp 00007F96C0E0BFDDh 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F75E1 second address: 11F75E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F78F1 second address: 11F78F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F78F9 second address: 11F7905 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F96C0CA2556h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F7905 second address: 11F790B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F7A5C second address: 11F7A6A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jc 00007F96C0CA2556h 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F7A6A second address: 11F7A8A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F96C0E0BFE2h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop eax 0x0000000b js 00007F96C0E0BFE2h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F7A8A second address: 11F7A90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119D55A second address: 119D55F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FEB10 second address: 11FEB30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F96C0CA2567h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FEB30 second address: 11FEB50 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96C0E0BFE6h 0x00000007 jo 00007F96C0E0BFD6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FEB50 second address: 11FEB68 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F96C0CA2562h 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FEB68 second address: 11FEB6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FECBE second address: 11FECD2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 jmp 00007F96C0CA255Eh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FECD2 second address: 11FECD6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FEF60 second address: 11FEF76 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F96C0CA2562h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FEF76 second address: 11FEF7A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FEF7A second address: 11FEFC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push edx 0x00000008 pop edx 0x00000009 jno 00007F96C0CA2556h 0x0000000f pop esi 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 pushad 0x00000014 jne 00007F96C0CA2556h 0x0000001a je 00007F96C0CA2556h 0x00000020 popad 0x00000021 push esi 0x00000022 pushad 0x00000023 popad 0x00000024 pushad 0x00000025 popad 0x00000026 pop esi 0x00000027 je 00007F96C0CA2562h 0x0000002d push eax 0x0000002e push edx 0x0000002f jmp 00007F96C0CA255Bh 0x00000034 jp 00007F96C0CA2556h 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FFAAF second address: 11FFAB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FFAB5 second address: 11FFB0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F96C0CA255Bh 0x00000009 popad 0x0000000a popad 0x0000000b pushad 0x0000000c jc 00007F96C0CA2562h 0x00000012 jmp 00007F96C0CA2569h 0x00000017 jc 00007F96C0CA255Eh 0x0000001d push eax 0x0000001e push edx 0x0000001f js 00007F96C0CA2556h 0x00000025 pushad 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FFDD1 second address: 11FFDD5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FFDD5 second address: 11FFDDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FFDDB second address: 11FFDEC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007F96C0E0BFD6h 0x00000009 jc 00007F96C0E0BFD6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12000C6 second address: 12000CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12000CA second address: 12000E3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96C0E0BFDFh 0x00000007 jbe 00007F96C0E0BFD6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1208B73 second address: 1208B79 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1207ECB second address: 1207ED0 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1207ED0 second address: 1207EDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1207EDC second address: 1207EE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120806C second address: 1208072 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1208072 second address: 1208078 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1208358 second address: 120835C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120835C second address: 1208373 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96C0E0BFDDh 0x00000007 jl 00007F96C0E0BFD6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120E829 second address: 120E82F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120E9A7 second address: 120EA03 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F96C0E0BFDCh 0x00000008 pushad 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007F96C0E0BFDBh 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 jng 00007F96C0E0C022h 0x0000001b jnp 00007F96C0E0BFECh 0x00000021 push eax 0x00000022 pop eax 0x00000023 jmp 00007F96C0E0BFE4h 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b popad 0x0000002c jmp 00007F96C0E0BFE5h 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120EB47 second address: 120EB4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120EB4F second address: 120EB6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F96C0E0BFE6h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120EB6D second address: 120EB72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120ECDA second address: 120ECF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop esi 0x00000006 jbe 00007F96C0E0C000h 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F96C0E0BFDCh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120ECF4 second address: 120ED0A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96C0CA255Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120F128 second address: 120F12E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120F12E second address: 120F13A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120F13A second address: 120F140 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120F140 second address: 120F144 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120F144 second address: 120F150 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F96C0E0BFD6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120F85E second address: 120F862 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120F862 second address: 120F870 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jno 00007F96C0E0BFD6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120F870 second address: 120F87A instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F96C0CA2556h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120F87A second address: 120F886 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120F886 second address: 120F88A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120F88A second address: 120F890 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1223EC5 second address: 1223EE9 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 jno 00007F96C0CA2556h 0x0000000b pop ecx 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 pushad 0x00000012 popad 0x00000013 pushad 0x00000014 popad 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F96C0CA255Ch 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1223EE9 second address: 1223EED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1223EED second address: 1223EFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F96C0CA255Bh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1228ABB second address: 1228AD1 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F96C0E0BFD6h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jnl 00007F96C0E0BFD6h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1228AD1 second address: 1228AD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12285DB second address: 12285EF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96C0E0BFE0h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12285EF second address: 122860C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 pushad 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push edx 0x0000000c pop edx 0x0000000d jmp 00007F96C0CA255Eh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122860C second address: 1228632 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F96C0E0BFE7h 0x0000000a push eax 0x0000000b push edx 0x0000000c jo 00007F96C0E0BFD6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1228632 second address: 1228636 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1228761 second address: 1228767 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1228767 second address: 12287A4 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F96C0CA2562h 0x00000008 pushad 0x00000009 jl 00007F96C0CA2556h 0x0000000f jmp 00007F96C0CA255Dh 0x00000014 jno 00007F96C0CA2556h 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 jc 00007F96C0CA2556h 0x00000027 pushad 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12287A4 second address: 12287C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96C0E0BFDFh 0x00000007 je 00007F96C0E0BFD6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007F96C0E0BFDBh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12287C8 second address: 12287CD instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122D265 second address: 122D271 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 jns 00007F96C0E0BFD6h 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122D271 second address: 122D28F instructions: 0x00000000 rdtsc 0x00000002 jp 00007F96C0CA2558h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F96C0CA255Eh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122D28F second address: 122D2A7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96C0E0BFDAh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b js 00007F96C0E0BFD8h 0x00000011 push edx 0x00000012 pop edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122D2A7 second address: 122D2AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122BCA0 second address: 122BCA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122BCA7 second address: 122BCB3 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F96C0CA255Eh 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122BE3A second address: 122BE3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1235B7E second address: 1235B82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123C749 second address: 123C74F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123C74F second address: 123C75E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F96C0CA255Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123C75E second address: 123C772 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jng 00007F96C0E0BFD6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123CA23 second address: 123CA2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F96C0CA2556h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123CA2E second address: 123CA36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123CA36 second address: 123CA3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123CA3A second address: 123CA44 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F96C0E0BFD6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123CA44 second address: 123CA52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jne 00007F96C0CA2556h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1241557 second address: 124155D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124155D second address: 1241561 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1243359 second address: 1243363 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F96C0E0BFD6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1243363 second address: 1243369 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1242F3C second address: 1242F42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1242F42 second address: 1242F58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F96C0CA2561h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1242F58 second address: 1242F62 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F96C0E0BFDCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125F36B second address: 125F38D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96C0CA2568h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125F38D second address: 125F391 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125F391 second address: 125F397 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125F397 second address: 125F3A1 instructions: 0x00000000 rdtsc 0x00000002 je 00007F96C0E0BFDCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1266C72 second address: 1266C76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1266C76 second address: 1266C8A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007F96C0E0BFDEh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1266C8A second address: 1266CA6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 jmp 00007F96C0CA2562h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1266CA6 second address: 1266CAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1266CAA second address: 1266CAE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126639C second address: 12663AC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnl 00007F96C0E0BFD6h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12663AC second address: 12663B5 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12663B5 second address: 12663BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1266514 second address: 126652C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96C0CA255Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12666C0 second address: 12666F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F96C0E0BFDBh 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a push eax 0x0000000b pop eax 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F96C0E0BFE0h 0x0000001b jmp 00007F96C0E0BFDAh 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12666F6 second address: 12666FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12666FC second address: 1266706 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1266706 second address: 126670C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126A037 second address: 126A050 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F96C0E0BFDFh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126A050 second address: 126A074 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F96C0CA2556h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F96C0CA2568h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126A074 second address: 126A078 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12699D5 second address: 12699DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12699DE second address: 12699EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F96C0E0BFDAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12699EC second address: 1269A0C instructions: 0x00000000 rdtsc 0x00000002 jp 00007F96C0CA2556h 0x00000008 jmp 00007F96C0CA2566h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1269A0C second address: 1269A3F instructions: 0x00000000 rdtsc 0x00000002 jg 00007F96C0E0BFF9h 0x00000008 jmp 00007F96C0E0BFDCh 0x0000000d jmp 00007F96C0E0BFE7h 0x00000012 jp 00007F96C0E0BFDEh 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1269A3F second address: 1269A56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a js 00007F96C0CA255Ah 0x00000010 push edi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1269A56 second address: 1269A5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12723E9 second address: 127241A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96C0CA2567h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jnl 00007F96C0CA255Eh 0x00000011 push eax 0x00000012 push edx 0x00000013 push edi 0x00000014 pop edi 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127241A second address: 1272422 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1273E8A second address: 1273E91 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1273E91 second address: 1273E9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126AE86 second address: 126AE8A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126AE8A second address: 126AE96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F96C0E0BFD6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126AE96 second address: 126AE9C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126AE9C second address: 126AEA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1195276 second address: 1195280 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F96C0CA2556h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119541E second address: 1195441 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push ecx 0x00000009 pushad 0x0000000a jmp 00007F96C0E0BFE7h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: FDDCFA instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 11883FE instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 1218C86 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Memory allocated: 5640000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 58D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 78D0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_00FDE0D5 rdtsc

1_2_00FDE0D5

Source: C:\Users\user\Desktop\file.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\file.exe TID: 1908

Thread sleep time: -922337203685477s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_011C31DA GetSystemInfo,VirtualAlloc,

1_2_011C31DA

Source: C:\Users\user\Desktop\file.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: file.exe, file.exe, 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_00FDE0D5 rdtsc

1_2_00FDE0D5

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_00FDB988 LdrInitializeThunk,

1_2_00FDB988

Source: C:\Users\user\Desktop\file.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: file.exe, file.exe, 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: BProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_011BA93B GetSystemTime,GetFileTime,

1_2_011BA93B

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\Desktop\file.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Jump to behavior

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1	Jump to behavior

Disables Windows Defender Tamper protection

Source: C:\Users\user\Desktop\file.exe

Registry value created: TamperProtection 0

Jump to behavior

Modifies windows update settings

Source: C:\Users\user\Desktop\file.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Process Injection	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	41 Disable or Modify Tools	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Bypass User Account Control	261 Virtualization/Sandbox Evasion	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Process Injection	NTDS	261 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	24 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	2 Bypass User Account Control	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.XPACK.Gen
file.exe	100%	Joe Sandbox ML
file.exe	56%	Virustotal		Browse

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1533076
Start date and time:	2024-10-14 12:17:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.evad.winEXE@1/1@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, ctldl.windowsupdate.com
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtProtectVirtualMemory calls found.

Process:	C:\Users\user\Desktop\file.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.933263631974488
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'740'800 bytes
MD5:	b2337b7ef8afe55b28bdc11d27a7f160
SHA1:	e64ab79ef63c59c372f603bad020982821d0d7e3
SHA256:	2a223c2207a017da91da53683dade893aa77b3ce2298a4e3cbd80f5d92296e44
SHA512:	58cb3851c755883d8b49ce74545ff58c97459af546463edd8a82be666ed0576623ef7cdadda932f09d31aca99ccaba770953b1c1c28fb8e5a63b593938e3bf87
SSDEEP:	24576:hViHZ7P80WtmfJ1qWrwpA6MEE1PJGTt7YIj09d8bTVmL4AsLjrSXM/3/o27m8TQA:Xi570gJ1qW0pRMXLGpEIj09ysciM/Pw
TLSH:	D9853341BA0506EDDBFB5B71A80B971A1E307E91D97370031FC683E6A2A9767485CBE0
File Content Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$...........@E.. ...`....@.. ........................E.....;U....`................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x854000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE
Time Stamp:	0x652C2850 [Sun Oct 15 17:58:40 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F96C0D95CAAh
movd mm3, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8055	0x69	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x6000	0x59c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x81f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x2000	0x4000	0x1200	bea450ee51403bfba210c4955679d044	False	0.9325086805555556	data	7.802540159895336	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x6000	0x59c	0x600	aae15e30898a02f09cc86ed48aa06b09	False	0.4140625	data	4.036947054771808	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x8000	0x2000	0x200	ec9cb51e8cb4ea49a56ee3cf434fb69e	False	0.1484375	data	0.9342685949460681	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0xa000	0x2a4000	0x200	fc34ac43038af20b79476ddb84778b7e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
yiycfvys	0x2ae000	0x1a4000	0x1a2e00	9d567de6c02d04373de964baf66ccf2c	False	0.9950387943897344	data	7.953713263906357	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
gwlxbero	0x452000	0x2000	0x400	c61535045edf81850a36826ab97d8032	False	0.8125	data	6.384424435602764	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x454000	0x4000	0x2200	c032c03a98b36487f28620854bfd4bc5	False	0.054457720588235295	DOS executable (COM)	0.4473378753939987	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x6090	0x30c	data			0.42948717948717946
RT_MANIFEST	0x63ac	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
kernel32.dll	lstrcpy

Target ID:	1
Start time:	06:18:02
Start date:	14/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xfd0000
File size:	1'740'800 bytes
MD5 hash:	B2337B7EF8AFE55B28BDC11D27A7F160
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.7%
Dynamic/Decrypted Code Coverage:	2.8%
Signature Coverage:	3.3%
Total number of Nodes:	424
Total number of Limit Nodes:	26

Executed Functions

Function 011C31DA Relevance: 3.1, APIs: 2, Instructions: 107
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNELBASE(?,-112F5FEC), ref: 011C31E6
VirtualAlloc.KERNELBASE(00000000,00004000,00001000,00000004), ref: 011C3247

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID: AllocInfoSystemVirtual
String ID:
API String ID: 3440192736-0
Opcode ID: 4203ef1d4ccc5168911fc8c9c2021cba6182d89ef6d25a3b47ffec6fd9a045de
Instruction ID: 5fed146796d62e666fb057cd3d872cf78aa8e7473fca6ef5d833b709c46bbb93
Opcode Fuzzy Hash: 4203ef1d4ccc5168911fc8c9c2021cba6182d89ef6d25a3b47ffec6fd9a045de
Instruction Fuzzy Hash: AD4133B1D14206AFF729DF74CD05F96B7ACBB28B11F004196B202DE986DB7095D48BA4

Function 00FDB988 Relevance: 1.3, Strings: 1, Instructions: 35COMMON

Download Yara Rule

Strings

X, xrefs: 00FDB988

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID: X
API String ID: 0-1071751871
Opcode ID: a7b2ec953c54167418395dde5650b7ce34e6f1760dcabb7f9496fa3e8f0dc3ad
Instruction ID: 6fc6b6341715cae594bdbe9287154d6c388f4508176797768ce0fdc23d4d56cd
Opcode Fuzzy Hash: a7b2ec953c54167418395dde5650b7ce34e6f1760dcabb7f9496fa3e8f0dc3ad
Instruction Fuzzy Hash: 28F0B46191D3D2CFCB07AF344CA4088BF61EE1765471E45DBC0D4CB693D624585BD752

Function 011B7EC1 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 83
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(?,?,?), ref: 011B7FD2
LoadLibraryExA.KERNELBASE(00000000,?,?), ref: 011B7FE6

Strings

.dll, xrefs: 011B7F09
.exe, xrefs: 011B7F2D
1002, xrefs: 011B7F9C

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID: LibraryLoad
String ID: .dll$.exe$1002
API String ID: 1029625771-847511843
Opcode ID: a79cfd9b105a19e38b37f07eb152dcfa8ca555ceae060ecec3daa96aa173d31d
Instruction ID: 1305a9054223b62903e48c3eb021c09aa144078f580894179da4b865a72dc220
Opcode Fuzzy Hash: a79cfd9b105a19e38b37f07eb152dcfa8ca555ceae060ecec3daa96aa173d31d
Instruction Fuzzy Hash: 8431AB3140420AEFDF1DAF54D880AED7F75FFA8314F004869F912961E0D73199A0CBA6

Function 011B83C7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,011B8359,?,00000000,00000000), ref: 011B8484
GetModuleHandleA.KERNEL32(00000000,?,?,?,011B8359,?,00000000,00000000), ref: 011B8492

Strings

.dll, xrefs: 011B83FA

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID: HandleModule
String ID: .dll
API String ID: 4139908857-2738580789
Opcode ID: 83a63d10d7bf43bd55d51ff04e7150ce3d8b2da8f6b7e67c3e978509be74c20f
Instruction ID: ec7ab7c95b62380d8f67297c24ed360697c316b3dbd28898849ce9e66d6d3a66
Opcode Fuzzy Hash: 83a63d10d7bf43bd55d51ff04e7150ce3d8b2da8f6b7e67c3e978509be74c20f
Instruction Fuzzy Hash: 34115234100617EAEB3CAF58C8887DD7B78FF20B45F04462DE686444E0D77995D4CA92

Function 011BAD21 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNELBASE(018F2704,-112F5FEC), ref: 011BAD9A
GetFileAttributesA.KERNEL32(00000000,-112F5FEC), ref: 011BADA8

Strings

@, xrefs: 011BAD4D

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID: AttributesFile
String ID: @
API String ID: 3188754299-2726393805
Opcode ID: d860bc7c8299e0da3f919533105f859486bccdc520088ac9b0a759a9014fe212
Instruction ID: cbf55773d233994aa061c2624c93d36d190b2ce1cf09e9d651a86fd1818b24bc
Opcode Fuzzy Hash: d860bc7c8299e0da3f919533105f859486bccdc520088ac9b0a759a9014fe212
Instruction Fuzzy Hash: 2401AFB0204205FFEB2D9F68E9987DCBF70BF2034AF004165E603AB0A0E7709A94DB41

Function 011B6DA1 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 90
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PathAddExtensionA.KERNELBASE(?,00000000), ref: 011B6E03

Strings

\\?\, xrefs: 011B6E5E

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID: ExtensionPath
String ID: \\?\
API String ID: 158807944-4282027825
Opcode ID: 8fa2a6386854956296aa74181d94e39230d2385ebe4f0991eeeb616c5fa99c80
Instruction ID: eb7229f72badee0f38d0ce94194b60349dd38738373097945ef410a727bff564
Opcode Fuzzy Hash: 8fa2a6386854956296aa74181d94e39230d2385ebe4f0991eeeb616c5fa99c80
Instruction Fuzzy Hash: 9A316D3190021ABFEF26DF99CC88FDE7B79BF68744F004464FA01A54A0E7729661DB50

Function 011B84B0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 32
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 011B67EE: GetCurrentThreadId.KERNEL32 ref: 011B67FD

GetModuleHandleExA.KERNELBASE(?,?,?), ref: 011B8514

Strings

.dll, xrefs: 011B84D1

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID: CurrentHandleModuleThread
String ID: .dll
API String ID: 2752942033-2738580789
Opcode ID: bd19e552a12375c60d67cd30a4683c8645edd11fb024c58724cc868cecdaec3b
Instruction ID: 7ed13e818f81993fe4d477a9986bb8cfe4d51a1d5c634c882fadea7c7838d704
Opcode Fuzzy Hash: bd19e552a12375c60d67cd30a4683c8645edd11fb024c58724cc868cecdaec3b
Instruction Fuzzy Hash: E5F09AB1200306AFDF19EF58C8C8AEA7BA8BF28704F008024FF068A055D730D460DA61

Function 011BAF3D Relevance: 3.1, APIs: 2, Instructions: 57
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(018F2704,?,?,-112F5FEC,?,?,?,-112F5FEC,?), ref: 011BAFEF

Part of subcall function 011BAEEF: IsBadWritePtr.KERNEL32(?,00000004), ref: 011BAEFD

CreateFileA.KERNEL32(?,?,?,-112F5FEC,?,?,?,-112F5FEC,?), ref: 011BB00F

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID: CreateFile$Write
String ID:
API String ID: 1125675974-0
Opcode ID: f51d3384f6fd4e635e985a07730a4e4191cf07a77647fa9ab4adcb84a9801ab8
Instruction ID: cd70bafdcdea0d67e568b81d7fd7b6351101c70c144480fe79fd09d808e243fc
Opcode Fuzzy Hash: f51d3384f6fd4e635e985a07730a4e4191cf07a77647fa9ab4adcb84a9801ab8
Instruction Fuzzy Hash: 5611297110820AFADF2AAF94DD48BDE3E71BF24348F054119FA16564A0D77685B1EB42

Function 011BA8A9 Relevance: 3.0, APIs: 2, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 011B67EE: GetCurrentThreadId.KERNEL32 ref: 011B67FD

GetCurrentProcess.KERNEL32(-112F5FEC), ref: 011BA8B6
DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 011BA91C

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID: Current$DuplicateHandleProcessThread
String ID:
API String ID: 3748180921-0
Opcode ID: ce79c8a91fd4e1e50c0ac4ddafead91ba1bb14942fafe9981109c5c92639b94c
Instruction ID: 1b8d287b578de0118963f16e964475c92edb357a803144ea1bf7f43504e0d261
Opcode Fuzzy Hash: ce79c8a91fd4e1e50c0ac4ddafead91ba1bb14942fafe9981109c5c92639b94c
Instruction Fuzzy Hash: DC011D7610014AFB8F26AF98EC84CDE3F3ABFA82547054516FA0695410E736D171EB61

Function 011C3C06 Relevance: 1.6, APIs: 1, Instructions: 112
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cda7df0bfdabfdc78bf68fd52a6e312c9324db7bab910bc7a56cb639d12f2fe
Instruction ID: 1df591ab9c788a422300e77bdfc07a387bcfc98c5b27d6527eb83fe041ff9dcd
Opcode Fuzzy Hash: 6cda7df0bfdabfdc78bf68fd52a6e312c9324db7bab910bc7a56cb639d12f2fe
Instruction Fuzzy Hash: AB41A07191420AAFEB2DCF18C948BBD7BB1FF21B20F54C459E522AA591D331A890CB56

Function 011B8F28 Relevance: 1.6, APIs: 1, Instructions: 103
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000,?,00000000,00000010), ref: 011B8FDD

Part of subcall function 011B68CC: RtlAllocateHeap.NTDLL(00000000,00000000,011B6575,?,?,011B6575,00000008), ref: 011B68E6

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID: AllocateCreateFileHeap
String ID:
API String ID: 3125202945-0
Opcode ID: d36b21c388e50c0c4e060c80aca8a89e9f62d56b772808dcf169cdca3de4a36b
Instruction ID: 8c97028d06e3375fb5e5dd9a0f532fa634c3df834e8cd2a087b8ae6b5ca5e262
Opcode Fuzzy Hash: d36b21c388e50c0c4e060c80aca8a89e9f62d56b772808dcf169cdca3de4a36b
Instruction Fuzzy Hash: CE318DB1900209BAEB249F64DCC4FDDBBBCEF14718F108169F605AA190D7719552CB10

Function 011B8744 Relevance: 1.6, APIs: 1, Instructions: 92
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 011B68CC: RtlAllocateHeap.NTDLL(00000000,00000000,011B6575,?,?,011B6575,00000008), ref: 011B68E6

CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000,?,00000000), ref: 011B87C6

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID: AllocateCreateFileHeap
String ID:
API String ID: 3125202945-0
Opcode ID: 83009ac2c83819034b4fd76e945e79bba20d61487d51708f8cfe7df8b3821bd0
Instruction ID: 0c6cd800fb18bcd00709c858198f1d499e384822f022be6357ed8da2fcde024e
Opcode Fuzzy Hash: 83009ac2c83819034b4fd76e945e79bba20d61487d51708f8cfe7df8b3821bd0
Instruction Fuzzy Hash: 3F31D271600205FFEB249FA8EC85FD9B7BCEB04B28F208669F611AA4D1D7B1A151CB54

Function 011C3953 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNELBASE(?,?,0000028A,?,?), ref: 011C3A00

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID: FileModuleName
String ID:
API String ID: 514040917-0
Opcode ID: 1d0fe262951e6b33f4da2545922c1b996c28718240fcb4e59c53e5ce0cabcff8
Instruction ID: 59b71600067c764aef5d1771a91c674716b7d5959a84a958d30a10f422f0aa63
Opcode Fuzzy Hash: 1d0fe262951e6b33f4da2545922c1b996c28718240fcb4e59c53e5ce0cabcff8
Instruction Fuzzy Hash: 90118771E212359FEB295A1D8C48BEB776CFB18F50F10C099E519E6041E771DD908AA1

Function 05640D41 Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 05640DCD

Memory Dump Source

Source File: 00000001.00000002.2314894573.0000000005640000.00000040.00000800.00020000.00000000.sdmp, Offset: 05640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5640000_file.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 331f3b589493854f8085be109c837748df9f35854fcbadc0ba796b2a973284b8
Instruction ID: 6b5f08ea951233ab48ac618fab29172e5ce251d7223ce1b1e9b0aad2af6f48b1
Opcode Fuzzy Hash: 331f3b589493854f8085be109c837748df9f35854fcbadc0ba796b2a973284b8
Instruction Fuzzy Hash: F72116BA8002199FCB50CF99D988BDEBBF4BF88720F14851AD909AB304D774A544CFA4

Function 05640D48 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 05640DCD

Memory Dump Source

Source File: 00000001.00000002.2314894573.0000000005640000.00000040.00000800.00020000.00000000.sdmp, Offset: 05640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5640000_file.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 95de0072bf6bf687b0bf7709571ee903d615f9dd06c6d2055a32f8e088fa6754
Instruction ID: 8b779719812581b480f9d6012338637b43c9283e2064cea261ae65aec8e8ebdb
Opcode Fuzzy Hash: 95de0072bf6bf687b0bf7709571ee903d615f9dd06c6d2055a32f8e088fa6754
Instruction Fuzzy Hash: 212104B68052199FCB50CF99D884ADEFBF4FF88720F14851AD909AB305D774A544CFA4

Function 05641509 Relevance: 1.6, APIs: 1, Instructions: 54
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ControlService.ADVAPI32(?,?,?), ref: 05641580

Memory Dump Source

Source File: 00000001.00000002.2314894573.0000000005640000.00000040.00000800.00020000.00000000.sdmp, Offset: 05640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5640000_file.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: 12f69c9c07772a7adb9f10640b25242c19be6678770f2fea0ea5997ba770d272
Instruction ID: fb66ec7ba32baead871b95d2c8f7f309aa68b152ffe53f4af22d7bc51d09d2bf
Opcode Fuzzy Hash: 12f69c9c07772a7adb9f10640b25242c19be6678770f2fea0ea5997ba770d272
Instruction Fuzzy Hash: F32103B6900249DFDB10CF9AC584BDEBBF4AB48320F10842AE519A7250D378A644CFA5

Function 05641510 Relevance: 1.6, APIs: 1, Instructions: 54serviceCOMMON

Download Yara Rule

APIs

ControlService.ADVAPI32(?,?,?), ref: 05641580

Memory Dump Source

Source File: 00000001.00000002.2314894573.0000000005640000.00000040.00000800.00020000.00000000.sdmp, Offset: 05640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5640000_file.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: 0c9107ec3fb986ab4acb73495b049ad1f345391cdc29708ee3afef95b4351b4d
Instruction ID: 0b9fcbf1bfc112e33ddd30b017852d465019629d8980dffc0d808f1293d41473
Opcode Fuzzy Hash: 0c9107ec3fb986ab4acb73495b049ad1f345391cdc29708ee3afef95b4351b4d
Instruction Fuzzy Hash: AB11D3B59003499FDB10CF9AC584BDEFBF4AB48324F108429E559A7250D778A644CFA5

Function 011BBA75 Relevance: 1.6, APIs: 1, Instructions: 51fileCOMMON

Download Yara Rule

APIs

Part of subcall function 011B67EE: GetCurrentThreadId.KERNEL32 ref: 011B67FD

MapViewOfFileEx.KERNELBASE(?,?,?,?,?,?,-112F5FEC), ref: 011BBAFC

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID: CurrentFileThreadView
String ID:
API String ID: 1949693742-0
Opcode ID: 1ef95d4afde187c0f053b0bdc6ec566df0d8e170a787f9906b43e5b47d505126
Instruction ID: 7df2aa211edf850728b8514f5d5ad54a3e32d30773743bbfb4123be1f09df3eb
Opcode Fuzzy Hash: 1ef95d4afde187c0f053b0bdc6ec566df0d8e170a787f9906b43e5b47d505126
Instruction Fuzzy Hash: 5111097250420AFFCF2AAFA4CD84CDE3F6ABF68344B054415FA0245864C732D072EBA5

Function 05641301 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 05641367

Memory Dump Source

Source File: 00000001.00000002.2314894573.0000000005640000.00000040.00000800.00020000.00000000.sdmp, Offset: 05640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5640000_file.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: 567289dcbda024a07ac02b476a900636f6c23fd4c78710a131deea332219e737
Instruction ID: 0ef0c37d6e51904850fa5258194aec8f25778f84d519bcb148a7c62092ce2515
Opcode Fuzzy Hash: 567289dcbda024a07ac02b476a900636f6c23fd4c78710a131deea332219e737
Instruction Fuzzy Hash: F51158B1800349CFDB10DF9AC444BDEBBF4EF48324F20842AE918A3640C778A544CFA1

Function 011BB85D Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 0430218ffb92d535dfff4a90803f3fb712e15dc91c9cffe8a1409a373ceba16e
Instruction ID: a85a8d1e589ddbc1da09553fa03f340f00f2f8a8c29592441037eb9fa32d947b
Opcode Fuzzy Hash: 0430218ffb92d535dfff4a90803f3fb712e15dc91c9cffe8a1409a373ceba16e
Instruction Fuzzy Hash: 7C116DB250420AEFDF1AAFA8C888EDE3F79AF14348F048465FA0589860D735C561EB91

Function 05641308 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 05641367

Memory Dump Source

Source File: 00000001.00000002.2314894573.0000000005640000.00000040.00000800.00020000.00000000.sdmp, Offset: 05640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5640000_file.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: 8f5f5343d197967a9e431be390f98e6aa42d9ed55b267fb5d166810e7e586b41
Instruction ID: 0895ee69263ad80297d20feac72357a496497b08a664ab3e0153088c9a6cfcab
Opcode Fuzzy Hash: 8f5f5343d197967a9e431be390f98e6aa42d9ed55b267fb5d166810e7e586b41
Instruction Fuzzy Hash: B51122B1800349CFDB20DF9AC544BDEBBF8AB48724F20842AD518A3650D778A984CFA5

Function 011BB141 Relevance: 1.5, APIs: 1, Instructions: 38fileCOMMON

Download Yara Rule

APIs

Part of subcall function 011B67EE: GetCurrentThreadId.KERNEL32 ref: 011B67FD

ReadFile.KERNELBASE(?,00000000,?,00000400,?,-112F5FEC,?,?,011B8E70,?,?,00000400,?,00000000,?,00000000), ref: 011BB1AD

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID: CurrentFileReadThread
String ID:
API String ID: 2348311434-0
Opcode ID: 136d84a89aff66c76b306380a16cf8862f4192fb9c8652519d3cd25f2b05ad52
Instruction ID: fdf190ee5e310099c57015d9c4ac607e73e0e3543246ec9b66d653fde9aa6f24
Opcode Fuzzy Hash: 136d84a89aff66c76b306380a16cf8862f4192fb9c8652519d3cd25f2b05ad52
Instruction Fuzzy Hash: E5F0FF7210410AFBCF1A9F98EC84DDE3F66BF65384F054525FA0699460D732C471DBA5

Function 011B68CC Relevance: 1.5, APIs: 1, Instructions: 15memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00000000,011B6575,?,?,011B6575,00000008), ref: 011B68E6

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 1dd46dd8aefbcf0b3accafb538dd7149f64b194f3a0ae3f4cd98ba24ad323b33
Instruction ID: 720b8f40ed8c4f24ca3d9770270b21767f176f8ce2ed2a3b5f8a88302d88f7b4
Opcode Fuzzy Hash: 1dd46dd8aefbcf0b3accafb538dd7149f64b194f3a0ae3f4cd98ba24ad323b33
Instruction Fuzzy Hash: 66D012B2601205BBDE205E59DC09F9F7EBCEBE6B90F400525F60290444E769E061D5B5

Function 011B69BF Relevance: 1.3, APIs: 1, Instructions: 39stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?,?), ref: 011B6A23

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: 1cbc0ebac8d068d1a8173e20e92f7d3ab81aa3a30721e7c507ab19771bb66187
Instruction ID: ca592d041479841395230561a8f26d83b76df787d9deb11c61901932f589c7c7
Opcode Fuzzy Hash: 1cbc0ebac8d068d1a8173e20e92f7d3ab81aa3a30721e7c507ab19771bb66187
Instruction Fuzzy Hash: 3601F632A0020EBFDF219FA9CC88DDEBF76FF64340F0055A5E505A4464E7729661DB60

Function 011C357D Relevance: 1.3, APIs: 1, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00001000,00001000,00000004,?,?,011C3579,?,?,011C327F,?,?,011C327F,?,?,011C327F), ref: 011C359D

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 0783090a79f41731811671212919c86c2d2bc7ffa53a2b5bfa6dde6cf07eaf13
Instruction ID: 309e4ed1a0c488e5cab6058b59acced590ed2b9b0423ef9884606a1e3cd56296
Opcode Fuzzy Hash: 0783090a79f41731811671212919c86c2d2bc7ffa53a2b5bfa6dde6cf07eaf13
Instruction Fuzzy Hash: EAF081B1900205EFEB298F14CD09B59BBE4FF69B62F10C469F54A9B951D3B194D0CB50

Function 011B9542 Relevance: 1.3, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

Part of subcall function 011B67EE: GetCurrentThreadId.KERNEL32 ref: 011B67FD

CloseHandle.KERNELBASE(011B8F05,-112F5FEC,?,?,011B8F05,?), ref: 011B9580

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID: CloseCurrentHandleThread
String ID:
API String ID: 3305057742-0
Opcode ID: fd5e6c82786f42b9c5e88581ffc612593219eed03951be435c86a9430ddb2369
Instruction ID: 6440b6e13e14249de3453c883154f7666a8d8c70aedb0b269698f3b5af33803d
Opcode Fuzzy Hash: fd5e6c82786f42b9c5e88581ffc612593219eed03951be435c86a9430ddb2369
Instruction Fuzzy Hash: 76E048E664050A76DE286BB8D888CCD1B1D5FB124C7004536E20389450DB35D152C661

Function 00FDE9F3 Relevance: 1.3, APIs: 1, Instructions: 10memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 00FDE9F8

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 428e7ce317e09784615a62de81eca606b69906a58687e5f9aed91d9e9cd18d0f
Instruction ID: 628ad608c43c3382a09c10b1d79cc857a995b662583867578edbd87e957785fc
Opcode Fuzzy Hash: 428e7ce317e09784615a62de81eca606b69906a58687e5f9aed91d9e9cd18d0f
Instruction Fuzzy Hash: CFD0127180864ECFDF542F70880C7EE3A60EF11722F140316FC2281AC0D7310C10EA15

Function 00FDEC15 Relevance: 1.3, APIs: 1, Instructions: 9memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 00FDEC17

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 30a6bea1f572ec5679a63a181a6a95f19bb2ede9cca2f37f0c5cbe6c9f6ae46f
Instruction ID: 0570ff523ecb61b59326f4fda07aa856bb1f1e52da524f1373dc598e14fdc322
Opcode Fuzzy Hash: 30a6bea1f572ec5679a63a181a6a95f19bb2ede9cca2f37f0c5cbe6c9f6ae46f
Instruction Fuzzy Hash: 98C04CB6458649EED7447F204844BBF79A5EB99741F14041DA84685740D1610C11E629

Function 011B8607 Relevance: 1.3, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,011B668D,?,?), ref: 011B860D

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: f343037ecb387cead68aed73202cdb20e50ad988bf86720faa5ddf29463ffb6b
Instruction ID: 58c98389bc1628aa40ff6691bc19f86d183466b47fa5b25434b900e7be2b0fa8
Opcode Fuzzy Hash: f343037ecb387cead68aed73202cdb20e50ad988bf86720faa5ddf29463ffb6b
Instruction Fuzzy Hash: 9AB09231000509BBDB11BF91DC05C8DBF69BF3A698B00C220FA46444209B72EA749B90

Non-executed Functions

Function 01151308 Relevance: 7.9, Strings: 5, Instructions: 1603COMMON

Download Yara Rule

Strings

"#s}, xrefs: 011520F7
/@|&, xrefs: 01151A82
@D?o, xrefs: 01151BE5, 01151DA7, 01151BEE, 01151BF8, 01151CD4, 01151D6F, 01151DB8, 01151DE4, 01151E36, 01151E6E
,dz, xrefs: 01151DB9
)Y;W, xrefs: 01151A6F

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID: "#s}$)Y;W$,dz$/@|&$@D?o
API String ID: 0-2130884036
Opcode ID: bd1a21642387372b268e67552d1495e3d047366a5deef3468bbda9ae7432c04f
Instruction ID: 7e4f4a45cbe8b7433b7914f0f93251a33a5671f1dc33bc557d2f84c251099b6f
Opcode Fuzzy Hash: bd1a21642387372b268e67552d1495e3d047366a5deef3468bbda9ae7432c04f
Instruction Fuzzy Hash: FFB2F6F360C204AFE3046E2DEC8567ABBE9EF94720F1A493DEAC4C7744E63558058697

Function 010750D6 Relevance: 4.3, Strings: 3, Instructions: 569COMMON

Download Yara Rule

Strings

=>63, xrefs: 010757DF
vt, xrefs: 01075728
/!R5, xrefs: 0107564B

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID: /!R5$=>63$vt
API String ID: 0-4202463949
Opcode ID: e270c2cc28e73586e5215a5e17ab35830aec4d553206a6ffc1a93afaca5a390a
Instruction ID: cf127c301caa82952b0a014020aeb95514a87e0ddc0c5a4bd4920124b79c212c
Opcode Fuzzy Hash: e270c2cc28e73586e5215a5e17ab35830aec4d553206a6ffc1a93afaca5a390a
Instruction Fuzzy Hash: 8602D0F3F116244BF3145D39DC883A67682DB95324F2F86389F989B7C5E83E9C0A4285

Function 010C406E Relevance: 2.9, Strings: 2, Instructions: 388COMMON

Download Yara Rule

Strings

&[;}, xrefs: 010C4400
Tyu|, xrefs: 010C4583

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID: &[;}$Tyu|
API String ID: 0-579018218
Opcode ID: b9cefb81c01597afbe4a761eb97891f3d314c2f1932c918e74f97ae2f7a72269
Instruction ID: 09b7264566538056537a037acf0e6a9fbe61a90adaa6303bd4d0d2ef602be366
Opcode Fuzzy Hash: b9cefb81c01597afbe4a761eb97891f3d314c2f1932c918e74f97ae2f7a72269
Instruction Fuzzy Hash: 19C1F2F3F116244BF3544E29DC953667692DBE8320F2F823C9A899B3C4E97E5C0A4385

Function 010B9117 Relevance: 2.8, Strings: 2, Instructions: 295COMMON

Download Yara Rule

Strings

YV, xrefs: 010B9384
O, xrefs: 010B9233

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID: O$YV
API String ID: 0-851602031
Opcode ID: 5cac9bd3dc30c49b502d0c4405daa591508d9885770db1bd760238abb33a8ebd
Instruction ID: f4ecc7cae131bcc5da73810b571c1290caeb3a4082011a1ebd66b2402d6c846c
Opcode Fuzzy Hash: 5cac9bd3dc30c49b502d0c4405daa591508d9885770db1bd760238abb33a8ebd
Instruction Fuzzy Hash: 21A1ACF3F1162547F3584928CCA83A66682D7A5315F2F82788F59AB7C9DC7E9C0A43C4

Function 0100E2CD Relevance: 2.7, Strings: 2, Instructions: 167COMMON

Download Yara Rule

Strings

R, xrefs: 0100E394
]^@F, xrefs: 0100E3C5

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID: R$]^@F
API String ID: 0-4098293502
Opcode ID: 23bba0dd6f9e50c51443e7b7dff3b5ebc7a9d57a12ea1fdb6e4d402f37c6d321
Instruction ID: f7856b0e3c33e11aa44f839afb88b8c89ba10e993a176b113e83e2f28f7642d1
Opcode Fuzzy Hash: 23bba0dd6f9e50c51443e7b7dff3b5ebc7a9d57a12ea1fdb6e4d402f37c6d321
Instruction Fuzzy Hash: EA517AB3F515204BF3584D28CCA83B62683DBC5315F2E82BD8A896B7C9D97E6D095384

Function 01096510 Relevance: 1.7, Strings: 1, Instructions: 483COMMON

Download Yara Rule

Strings

71*Y, xrefs: 0109691C

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID: 71*Y
API String ID: 0-349025755
Opcode ID: 4ef702a041c45ff6596868397c2b004072f92b61042d97cc788fe0dbd10def95
Instruction ID: fd67c97b31272036b42f43f262ba60fe7faf9961e28a2c7e8c0d98e410d212d8
Opcode Fuzzy Hash: 4ef702a041c45ff6596868397c2b004072f92b61042d97cc788fe0dbd10def95
Instruction Fuzzy Hash: 16F1EFB3F042144BF3045E2DDC99366B6D2EBD4320F2B823DDA999B7C5E97D98058385

Function 010C90B9 Relevance: 1.7, Strings: 1, Instructions: 480COMMON

Download Yara Rule

Strings

\, xrefs: 010C91C3

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID: \
API String ID: 0-2967466578
Opcode ID: 42f3d3ec4b8893604053c0a83ae78d54993a86419e5fa05f950d10d8d09bf1c2
Instruction ID: c85c7aaf7e277ca924952762c09384fbb3387b0d9ea981a4b87e8f6395922ed4
Opcode Fuzzy Hash: 42f3d3ec4b8893604053c0a83ae78d54993a86419e5fa05f950d10d8d09bf1c2
Instruction Fuzzy Hash: 22F1DFB3F016104BF3084939DD59366BAD3DBD4320F2F823D9A999B7C8E97E9C064685

Function 0110333C Relevance: 1.7, Strings: 1, Instructions: 457COMMON

Download Yara Rule

Strings

0{@r, xrefs: 01103404

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID: 0{@r
API String ID: 0-3350855449
Opcode ID: aef67b1292b438535d04d5274c3c9909d636f842da4bedf488f9110e73173e5e
Instruction ID: 2303074281d4e29c2cd305ef2de1e972d63ae9999dd08da2a523b728b030730f
Opcode Fuzzy Hash: aef67b1292b438535d04d5274c3c9909d636f842da4bedf488f9110e73173e5e
Instruction Fuzzy Hash: D6F1C0B3F146148BF3045E29DC8536AB7D2EB91324F2B863CDA88977C4DA3E9C458785

Function 010003E2 Relevance: 1.7, Strings: 1, Instructions: 432COMMON

Download Yara Rule

Strings

#^, xrefs: 01000864

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID: #^
API String ID: 0-1417463511
Opcode ID: 36ee768da26aec91d095b0343b01883a71f9de214291b045fc00904ba109a1b1
Instruction ID: e688ea0f6e7d8ad457357c16b8fa3685bc27f38a995aac49a9665f8c45794821
Opcode Fuzzy Hash: 36ee768da26aec91d095b0343b01883a71f9de214291b045fc00904ba109a1b1
Instruction Fuzzy Hash: 26E1EDB3F116244BF3445D39DC983667692EB94720F2B823CDE88AB7C5E97E9D094384

Function 010980CE Relevance: 1.7, Strings: 1, Instructions: 429COMMON

Download Yara Rule

Strings

gdfo, xrefs: 0109852F

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID: gdfo
API String ID: 0-650232754
Opcode ID: 19f8c78412af1f2234cb2b7cf0688c14e1d707fa87001169704bd0c515ddb23f
Instruction ID: 37949eeef2abe9ae8b5f42e076e7a03e420860c547a1a752a1d00eaa3db916df
Opcode Fuzzy Hash: 19f8c78412af1f2234cb2b7cf0688c14e1d707fa87001169704bd0c515ddb23f
Instruction Fuzzy Hash: 63D1FFB3F046148BF3145E39DC98366B7D6EBA4320F2F463D9A88977C4E97E5C068285

Function 0108A0D0 Relevance: 1.7, Strings: 1, Instructions: 404COMMON

Download Yara Rule

Strings

BI]}, xrefs: 0108A442

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID: BI]}
API String ID: 0-1320408957
Opcode ID: b2ef9b7ce527fca65c0e186d30ae28310c0e402308f5fedd3c9b12d7fc3d0c1e
Instruction ID: 7593d7cdaf5220136f55d22f08665e0216aaa7389e69a9aad5c007f4481fdd1d
Opcode Fuzzy Hash: b2ef9b7ce527fca65c0e186d30ae28310c0e402308f5fedd3c9b12d7fc3d0c1e
Instruction Fuzzy Hash: 7ED1C0B3F146244BF3085929DC993A6B692EBD4320F2B423D9F89A77C4D97E5C0582C5

Function 010F1299 Relevance: 1.6, Strings: 1, Instructions: 326COMMON

Download Yara Rule

Strings

!, xrefs: 010F12F8

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID: !
API String ID: 0-2657877971
Opcode ID: bb5f4da72f98aec256f8dc2ff0126d85494fb85946addfede759583534acbf87
Instruction ID: d0464b862f9fe8c9b71df01c7cfa1c79f9b342818989d87c91ab49f40d595ca9
Opcode Fuzzy Hash: bb5f4da72f98aec256f8dc2ff0126d85494fb85946addfede759583534acbf87
Instruction Fuzzy Hash: 9AB1AAF3E106354BF3604978DD883626692AB95324F2F82788E9C7BBC6D87E5D0953C4

Function 010AF0BA Relevance: 1.6, Strings: 1, Instructions: 324COMMON

Download Yara Rule

Strings

r7, xrefs: 010AF274

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID: r7
API String ID: 0-3975731467
Opcode ID: 67441276973cc0240c79a7b4c149059d677d900db644fbd1edd2424f202d9657
Instruction ID: 841901f1bd6d7b6dc6c22db366c8811e887613d587769df01cbb6cdbd252cbe4
Opcode Fuzzy Hash: 67441276973cc0240c79a7b4c149059d677d900db644fbd1edd2424f202d9657
Instruction Fuzzy Hash: 20B1EFF3F6062547F3544969DC983626282DBE5321F2F82788E9CABBC5DC7E5C0A4384

Function 010511A0 Relevance: 1.5, Strings: 1, Instructions: 294COMMON

Download Yara Rule

Strings

B, xrefs: 01051200

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID: B
API String ID: 0-1255198513
Opcode ID: f1ce78e433aee594fe7fec7703236544b5b1723c0976a48a2dbc5c86233110ed
Instruction ID: 81e8abf6cff741578046cde41a515e5d6d4cd10b7726e1b2c9565297eb5b8c28
Opcode Fuzzy Hash: f1ce78e433aee594fe7fec7703236544b5b1723c0976a48a2dbc5c86233110ed
Instruction Fuzzy Hash: 88A1AFB3F106254BF3544969CC943626683EBD5321F2F82798F58ABBC5DC7D9C0A5384

Function 010FE251 Relevance: 1.5, Strings: 1, Instructions: 284COMMON

Download Yara Rule

Strings

&, xrefs: 010FE41F

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID: &
API String ID: 0-1010288
Opcode ID: 313d98d374d4e349025a2f7eb5c91d7548ceb75d02937459131d0dbc6f6ecc76
Instruction ID: 35457e65404d990c37d4c395bcb443fddd1d1965ce5ee9fe3e24396cb8e29626
Opcode Fuzzy Hash: 313d98d374d4e349025a2f7eb5c91d7548ceb75d02937459131d0dbc6f6ecc76
Instruction Fuzzy Hash: 42A18BF3F1162547F3580869DC693A26683DBD1321F2F82388F59AB7C5ED7E9C0A5284

Function 010C1234 Relevance: 1.5, Strings: 1, Instructions: 277COMMON

Download Yara Rule

Strings

@, xrefs: 010C1352

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: d985a9ccc6d091c9d2b08828dd37913b3aeee691c5da98c0c133e9e0be504eaf
Instruction ID: ae679e9f7a8fbb6872b22746ef2cb5635a0c5d9fc4c49f452cd599c1d7984511
Opcode Fuzzy Hash: d985a9ccc6d091c9d2b08828dd37913b3aeee691c5da98c0c133e9e0be504eaf
Instruction Fuzzy Hash: 8FA159B3F115254BF3448939CD583622683EBD5315F2F82788F89ABBD9D83D9D0A5388

Function 010340FF Relevance: 1.5, Strings: 1, Instructions: 275COMMON

Download Yara Rule

Strings

', xrefs: 010342DA

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID: '
API String ID: 0-1997036262
Opcode ID: d3ffacff72fc5d853260b71c0f048a07080e18bac5eea897b850c071aecf9727
Instruction ID: 5347a11347162505f4410fd81d3241ffd1723e1d52a17d0b695fa31faf2fe9ab
Opcode Fuzzy Hash: d3ffacff72fc5d853260b71c0f048a07080e18bac5eea897b850c071aecf9727
Instruction Fuzzy Hash: AEA179B3F106254BF3544D38DC983666692EB95324F2F82788E9C6BBC5D93E6D0A43C4

Function 01138082 Relevance: 1.5, Strings: 1, Instructions: 265COMMON

Download Yara Rule

Strings

1, xrefs: 0113816F

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID: 1
API String ID: 0-2212294583
Opcode ID: f9ba934ae08bf3836cdba80ea0cce08039676c28ceefde138019314a10f08fcf
Instruction ID: 95c9fe4c0cefb5b63d178872cb78b8ddf86d324136f99d099710254e2b6b1950
Opcode Fuzzy Hash: f9ba934ae08bf3836cdba80ea0cce08039676c28ceefde138019314a10f08fcf
Instruction Fuzzy Hash: E091CDB3F106254BF3544D68CC983626682EB95321F2F82788F4CAB7C9D97E6C0A53C4

Function 010E00A9 Relevance: 1.5, Strings: 1, Instructions: 241COMMON

Download Yara Rule

Strings

F, xrefs: 010E0186

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID: F
API String ID: 0-1304234792
Opcode ID: d12c61f244b8ee6d337504a4bdd942e7d1e0d85d3ec2c0dde0ecfbbf17e51e16
Instruction ID: 087e49860187fc6f2cc5bf73194166bbaa0990ac9e0e87e2a32c3ff677c8d65b
Opcode Fuzzy Hash: d12c61f244b8ee6d337504a4bdd942e7d1e0d85d3ec2c0dde0ecfbbf17e51e16
Instruction Fuzzy Hash: AD819DB3F115244BF3544979DD983A26683DBD4315F2F82388E8CAB7C9ED7E9C0A5284

Function 00FEC13B Relevance: 1.5, Strings: 1, Instructions: 226COMMON

Download Yara Rule

Strings

EJEp, xrefs: 00FEC394

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID: EJEp
API String ID: 0-763934073
Opcode ID: 577681d38fa8407215e367c59bca4bd4fbd3bbcfc61c73e3e3b74910f6979731
Instruction ID: f0c806e14db2c660d95efad636e963fe81a088deeecbb61b00cba32d15a7cb13
Opcode Fuzzy Hash: 577681d38fa8407215e367c59bca4bd4fbd3bbcfc61c73e3e3b74910f6979731
Instruction Fuzzy Hash: FF716BB3F116254BF3540929CC583A26683ABD5321F2F82788E9C6B7C5DD7E5D0A53C4

Function 01140253 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

7, xrefs: 011402D7

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID: 7
API String ID: 0-1790921346
Opcode ID: 64e0ad4212504f0c26cdf44aa00bfd54deef39d23ba13b843329f03e368afd6c
Instruction ID: 5d526b35dddfeefdb70f238048e0278997118e78e11f6b425efbecb1c0f6c6fd
Opcode Fuzzy Hash: 64e0ad4212504f0c26cdf44aa00bfd54deef39d23ba13b843329f03e368afd6c
Instruction Fuzzy Hash: 41717BB3F116244BF3644D69CC983A27693AB91320F2F42788E9C6B7C5D97E9D0A53C4

Function 00FF716D Relevance: 1.5, Strings: 1, Instructions: 206COMMON

Download Yara Rule

Strings

S, xrefs: 00FF7201

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID: S
API String ID: 0-543223747
Opcode ID: ec93708bbe552f41e6cf163961ee839b1c422c8e02f2575592117ac664f976b9
Instruction ID: ba30898767633a7251106715f73f0f39dd723bf008aff07c05a08ec11069ea82
Opcode Fuzzy Hash: ec93708bbe552f41e6cf163961ee839b1c422c8e02f2575592117ac664f976b9
Instruction Fuzzy Hash: 9E71AEB3F001254BF3544E29DCA83627693EBD5314F2F81788A88AB7D5D97E6C069384

Function 01066267 Relevance: 1.5, Strings: 1, Instructions: 202COMMON

Download Yara Rule

Strings

pJM, xrefs: 010663BF

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID: pJM
API String ID: 0-2840275936
Opcode ID: 403da734cfd5266ec4fb5cc57ddcf216096a203731d4522fb5ad221a0804c720
Instruction ID: ec091901814b08b4d35915de9b50acfa4c96da0a8b66630de75dbecfe85facae
Opcode Fuzzy Hash: 403da734cfd5266ec4fb5cc57ddcf216096a203731d4522fb5ad221a0804c720
Instruction Fuzzy Hash: 5061C9B3F116248BF3440E29CC543627393EB95311F2E807D8A499B3D4EA7EAC099784

Function 01104202 Relevance: 1.4, Strings: 1, Instructions: 194COMMON

Download Yara Rule

Strings

*c0j, xrefs: 01104374

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID: *c0j
API String ID: 0-3598408586
Opcode ID: 9e205b9f7e7ca9ddd9698bdc35a79caffa4c6812c7eb145e9f48593589b6eb66
Instruction ID: ca21e62a8eb7d9273a40ae37aebf2adbe3f9487d9c4d75df1ec31b5ca96e3fac
Opcode Fuzzy Hash: 9e205b9f7e7ca9ddd9698bdc35a79caffa4c6812c7eb145e9f48593589b6eb66
Instruction Fuzzy Hash: 4261BCB3F1152547F358492ACC58362A683EBD5320F2F82788A9D6B7C9DC7E6C0A4384

Function 0107B0AC Relevance: 1.4, Strings: 1, Instructions: 165COMMON

Download Yara Rule

Strings

S, xrefs: 0107B197

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID: S
API String ID: 0-543223747
Opcode ID: c290b847050cd974e6765859d2c71d398260a95d8cc43dca5a39cc6e27501ad9
Instruction ID: 4970aabe36ebd1e1cae4273182c11366aaf1febf3e45dd048e5da0059ed6dcfd
Opcode Fuzzy Hash: c290b847050cd974e6765859d2c71d398260a95d8cc43dca5a39cc6e27501ad9
Instruction Fuzzy Hash: 01518AF7F1152507F3444968DC983A22552DBE5314F2F82788E4CAB7CAE87E9C0A53C4

Function 0110E135 Relevance: 1.4, Strings: 1, Instructions: 163COMMON

Download Yara Rule

Strings

h3, xrefs: 0110E2C9

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID: h3
API String ID: 0-3250950705
Opcode ID: 06379879d138a24b56068549c635d251c81cd53712a53057153e7672bd60d4ea
Instruction ID: 163ea5bbcc48ee770dffc85427004e6e648879094888ab0ce86eb69af46ff375
Opcode Fuzzy Hash: 06379879d138a24b56068549c635d251c81cd53712a53057153e7672bd60d4ea
Instruction Fuzzy Hash: 2951E0B3F006244BF3484E28DC993627252EBA9311F2F417C8E599B3D5D97E6D089788

Function 01087204 Relevance: 1.4, Strings: 1, Instructions: 163COMMON

Download Yara Rule

Strings

k{,, xrefs: 01087221

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID: k{,
API String ID: 0-2120145841
Opcode ID: 480c42ace560045f02cddfe289cebdc8278546e4e5ef76964a8bfb8c6ead8786
Instruction ID: 3107168a0daa7dfd0a54443be68ee8b3c57086ff9fe6c463bac2753e19496679
Opcode Fuzzy Hash: 480c42ace560045f02cddfe289cebdc8278546e4e5ef76964a8bfb8c6ead8786
Instruction Fuzzy Hash: 0F519AF3F216204BF3544978DC983A62682D795325F2F42788F9CAB7C1D9BE9D0A5384

Function 0110451E Relevance: .5, Instructions: 546COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cf31b8ea60b878275d3e769decf52c0731020d19a922b14b72b4f1cc2fe12b8
Instruction ID: f0be95577a94c228901f66802f00a162d345fc06bc400b744c9de63e4881d3ea
Opcode Fuzzy Hash: 7cf31b8ea60b878275d3e769decf52c0731020d19a922b14b72b4f1cc2fe12b8
Instruction Fuzzy Hash: 4812F4B3E142148BF3145E29DC583A6BA92EB94320F2F463CDEC89B7C4DA7E5C059785

Function 0102626D Relevance: .5, Instructions: 538COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3d14949e61dc28c3f9aa32bd50e5ab8fcf8fe856df45fc3d4725cbb05afe611
Instruction ID: 7eea75619ebac1054addf64d8a685ffec682af1ce5c97080415e065c223c311a
Opcode Fuzzy Hash: f3d14949e61dc28c3f9aa32bd50e5ab8fcf8fe856df45fc3d4725cbb05afe611
Instruction Fuzzy Hash: AA02ABF3F102204BF3085939DD98366BA96EBD4320F2E823D9B99977C8D97D9C064385

Function 010A728D Relevance: .5, Instructions: 509COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78334e0e1eabc8e2214d4e0fe3ccd30afb182c1885a8b115ab19121786ea6ba9
Instruction ID: 094d4126ad6bebd5b8fa07995e45bdfbd349b4112f9795b5361e29c619bb2a3b
Opcode Fuzzy Hash: 78334e0e1eabc8e2214d4e0fe3ccd30afb182c1885a8b115ab19121786ea6ba9
Instruction Fuzzy Hash: A3F1D1F3E106344BF3109E79DC88366B696DB94720F2F82389E88A77C5E97E5D0542C5

Function 0113F28A Relevance: .5, Instructions: 491COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3608c5e3002f8486b2267f1ebc0f52b8f4a83de12836e21496638d415c417a26
Instruction ID: 28dd3cf2b6f70138085c55b4b65fe0cb3cae36aa5137475a05944faf4fed5358
Opcode Fuzzy Hash: 3608c5e3002f8486b2267f1ebc0f52b8f4a83de12836e21496638d415c417a26
Instruction Fuzzy Hash: 22F1BFF3F116244BF3448969DC99366B6939BD4324F2F81398E8CAB7C5E87E9C064385

Function 0109136B Relevance: .5, Instructions: 483COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cc2289a3e64a97f35241545a17c6814034f38b2d1898773b6058aa1f36832d6
Instruction ID: c65ef03e3a591e3ef4c27435130955761fa146bd3bd24e1b0103d8eb6a719c37
Opcode Fuzzy Hash: 0cc2289a3e64a97f35241545a17c6814034f38b2d1898773b6058aa1f36832d6
Instruction Fuzzy Hash: E8F1BFF3F146208BF3045E29DC94376B692EB95320F2F423D9A989B7C4E97E9C058785

Function 0102308A Relevance: .5, Instructions: 467COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1454d15aa9276eb6d00169b66e9430e4031cf11b643b05bf0dbce4ffe45d9ca
Instruction ID: a8c805527618ca97494907b0ded5fa9859296a6054b1ef134497d0881aae7c17
Opcode Fuzzy Hash: c1454d15aa9276eb6d00169b66e9430e4031cf11b643b05bf0dbce4ffe45d9ca
Instruction Fuzzy Hash: F1F15CB3E6067547F7A5047CCD593A2588257A5324F2F42B8CF9CAB7C2D8BE8D4942C4

Function 010FF382 Relevance: .4, Instructions: 439COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06863268327d4b7f91aa081e4725864ccd0d9fdebc5b400841234ebae8dab706
Instruction ID: 64ae0f45b055532f94c7828ebe1cb86d99ccfca938b0b748924f6eab83a3a35f
Opcode Fuzzy Hash: 06863268327d4b7f91aa081e4725864ccd0d9fdebc5b400841234ebae8dab706
Instruction Fuzzy Hash: BAE1FFF3F142208BF3545E69DC84366B6D2EB94320F2B863D9B88A77C4E97E5C058385

Function 010371CC Relevance: .4, Instructions: 436COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f154779cf77a1726adaffd6f4705cd23e41e2fbecf119cc94a49ac5725eefe64
Instruction ID: e46bcb88f111bb0288949f77cebaf98fc0b46aaf61fe7e4672ca7b81d71048d6
Opcode Fuzzy Hash: f154779cf77a1726adaffd6f4705cd23e41e2fbecf119cc94a49ac5725eefe64
Instruction Fuzzy Hash: 16E1E1B3E156104BF3485E38DC98376BBA2EBD4310F2B823DDA89977C4E93D59058785

Function 010DA0A7 Relevance: .4, Instructions: 397COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6b9c010fcfab667bce6a56ffed987f5ac8d3e769136b3071651308ee151c21d
Instruction ID: 85ace3fec5757bc7dff3d23f16d2c569c0f34acdbe4373cf0acfcc72b4b5e6a5
Opcode Fuzzy Hash: f6b9c010fcfab667bce6a56ffed987f5ac8d3e769136b3071651308ee151c21d
Instruction Fuzzy Hash: 8EC1C1B3B101248BF3544E29DC94376B796EBD5320F2E423DDE889B7C4E97A6D098385

Function 0108B0C8 Relevance: .4, Instructions: 388COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07dae810c9c4a52b59b507e385e1cd15f5d1a733b9b0625683ddf943d60b65a4
Instruction ID: 5ba7ae8b9e486f3c3fa4d0018ae7abab6dbf0fd73facd254979c6b544cabe5d0
Opcode Fuzzy Hash: 07dae810c9c4a52b59b507e385e1cd15f5d1a733b9b0625683ddf943d60b65a4
Instruction Fuzzy Hash: 47D17CB3F506154BF3544978CD983A22583E795324F2F82788F59ABBC9DC7E8D0A5384

Function 0109E024 Relevance: .4, Instructions: 379COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cab406f45df1200b6b4822563f9750353574f2da6135fe7f8e562e4e2c62f0bb
Instruction ID: 8ae96c7c4669e07ba5b12195feb5a829298b21c2f565a1aca5131ad4042031f5
Opcode Fuzzy Hash: cab406f45df1200b6b4822563f9750353574f2da6135fe7f8e562e4e2c62f0bb
Instruction Fuzzy Hash: 5DD159F3F116254BF3544878DD983A2668397E4325F2F82788F5CABBC6D87E5D091284

Function 0111629B Relevance: .4, Instructions: 372COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca2de0265e4faf703b70681ae98ddb3ce1afc4c5f35b3c2e5bfaf88a5f1ebe63
Instruction ID: 1cef7614bf7fcbda4c3c186f3d54f9b8a54e901d1f83e48db4003e5bb6e53e0c
Opcode Fuzzy Hash: ca2de0265e4faf703b70681ae98ddb3ce1afc4c5f35b3c2e5bfaf88a5f1ebe63
Instruction Fuzzy Hash: B6C18AB3F116144BF3484839DCA83A26683E7D5324F2F827C8A999B7D5DC7E9D0A5384

Function 01137133 Relevance: .4, Instructions: 364COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cb9d1fd8e356be3b9d23b5319d00972db883ac4b6b0c0b9b45daceed140576e
Instruction ID: e315988792de1c1e38f0da7cfbca00662506c1c0220288d7d4a5b6b4d2aafdd5
Opcode Fuzzy Hash: 5cb9d1fd8e356be3b9d23b5319d00972db883ac4b6b0c0b9b45daceed140576e
Instruction Fuzzy Hash: B7C17BF3F226144BF3444829DD993A2254397E5325F3F82788A5C9B7C6ECBE9C0A5384

Function 010D30D5 Relevance: .4, Instructions: 364COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99555b9eca67f26a6f34cae0ef4f01bb4f488bbceb8d2836ca10afda543b16aa
Instruction ID: a79c47b255bf11279717015fb13aeaa09ac63c3b4138a81593729bc590dff1b3
Opcode Fuzzy Hash: 99555b9eca67f26a6f34cae0ef4f01bb4f488bbceb8d2836ca10afda543b16aa
Instruction Fuzzy Hash: C2C179F3F116250BF3484879CD683A265839BE5325F2F82788F696B7C6DC7E5C0A1284

Function 01131318 Relevance: .4, Instructions: 360COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55e40b10a8c9f530c2cd436091925985742a6bbf8a1c182bf3885180cce3b7d8
Instruction ID: 9aa7561a4bb9f5f6a2429ca15d55973f037078f93cce09867199ae40e58d2826
Opcode Fuzzy Hash: 55e40b10a8c9f530c2cd436091925985742a6bbf8a1c182bf3885180cce3b7d8
Instruction Fuzzy Hash: C0C1ABB3F506244BF3544968CC993A27282E795324F2F82788E9CAB7C5DD7E9C0A53C4

Function 0103E3B8 Relevance: .4, Instructions: 357COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 442ad8bc78d14802984c34e2fbdc3897ad5fe3dfc86d17d8db99736d0557718d
Instruction ID: 96937eee7adfd240c83102674832eff0162d10eb94fcae2710131f7f4ef0fac1
Opcode Fuzzy Hash: 442ad8bc78d14802984c34e2fbdc3897ad5fe3dfc86d17d8db99736d0557718d
Instruction Fuzzy Hash: BCC179B3F5152547F3540969CD583A2AA93ABD1320F2F82788E4CABBC5DD7E9C0A53C0

Function 010551FA Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12b93c2667d35a3a0ebb9feb07636676547fccb5c73dd9b8751af256c2b2b9e9
Instruction ID: 77f26dd576d28a99bc858ce71463e9d75d3595445aa90eb0458233da61fcfcd4
Opcode Fuzzy Hash: 12b93c2667d35a3a0ebb9feb07636676547fccb5c73dd9b8751af256c2b2b9e9
Instruction Fuzzy Hash: 17C167B3F1152547F3984839CD683A665839BD4320F2F82798EADAB7C5DC7E9C065384

Function 010E6301 Relevance: .3, Instructions: 342COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bd86987e87a42b5dc6381ec5de12c972d5e65863076bd7788859d9a3984275b
Instruction ID: 088f9ce9eb50b8e59e52f112bf37bdfc85daed976b9bbf62fa4817c1ca96b52c
Opcode Fuzzy Hash: 0bd86987e87a42b5dc6381ec5de12c972d5e65863076bd7788859d9a3984275b
Instruction Fuzzy Hash: 50C17DB7F115254BF3444879CD583A26683ABE5325F3F82788A5CABBC5DC7E9C0A1384

Function 010F8501 Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a30f36e2f403a1187709429f065f6173be15435b9ca43fc717309a8ce70d65fe
Instruction ID: 79103fcde9e6e5561c9607808550d797b5bab711de18a638c3ea105c82f3000e
Opcode Fuzzy Hash: a30f36e2f403a1187709429f065f6173be15435b9ca43fc717309a8ce70d65fe
Instruction Fuzzy Hash: A2B1BFB3F1162547F3444978CD983A2668397D5321F2F82798E5CAB7C6DCBE9C0A1384

Function 01090312 Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dada80682f7b607ee8e1f9df74c950144a5b11018505267fec6c2aa2c7393cde
Instruction ID: 4a0a47681d62ef6f5d6b013097bd6eb4f79409226b4088517d1959339092c7a8
Opcode Fuzzy Hash: dada80682f7b607ee8e1f9df74c950144a5b11018505267fec6c2aa2c7393cde
Instruction Fuzzy Hash: 9CB19DB3E106364BF3644D79CD58362A6829B95324F2F82788E9CBB7C5E86E5C0953C4

Function 0111F177 Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7f353ed0475cce4d708de4eaffc7d65255ad24699b6b13b456a22aeb46ab9fb
Instruction ID: ab6e840fa19e32bb8c8aac2e85bf10f7b062fd08026ce76aa95b5b991a18571b
Opcode Fuzzy Hash: b7f353ed0475cce4d708de4eaffc7d65255ad24699b6b13b456a22aeb46ab9fb
Instruction Fuzzy Hash: 8BB19BB3F2123547F3944978CD583A26692EB95314F2F82788E4CAB7C9D87E9C0A53C4

Function 010170AF Relevance: .3, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aab7e7f0fc7d54147479372cd20e17332d7b7392c981d1eb7dc8315ed287590b
Instruction ID: 1b338cf68fc45f4ec788433381360e7b708ee30b4dc56e12f6a113fbe6e6a517
Opcode Fuzzy Hash: aab7e7f0fc7d54147479372cd20e17332d7b7392c981d1eb7dc8315ed287590b
Instruction Fuzzy Hash: 74B17BF3F516214BF3584878DDA83626683DBA1315F2F827C8F996B7C9D87E5C0A4284

Function 0100B3EB Relevance: .3, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c7b8434262c5db2862fa06414f60f4f64623b2ebe08f2077c00ab70d81d9b30
Instruction ID: 793225f6f2921680bec4434578935fde64ac5d7e164222c90dfbf56667241721
Opcode Fuzzy Hash: 5c7b8434262c5db2862fa06414f60f4f64623b2ebe08f2077c00ab70d81d9b30
Instruction Fuzzy Hash: F4B18BB3F115254BF39849A8CC983A26682E794324F2F82788F5CAB7C5ED7E5D0953C4

Function 0106517A Relevance: .3, Instructions: 328COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2972374db9272db6af5441f58996a60acac205c296c2e9ebd9949e44e1adf4c4
Instruction ID: e9a21a8c685046a5fa228afb8ebe379f25ccc9c73ddd70e359efb61b90726725
Opcode Fuzzy Hash: 2972374db9272db6af5441f58996a60acac205c296c2e9ebd9949e44e1adf4c4
Instruction Fuzzy Hash: 23B18BB3F116254BF3484D38CDA83A66683D7D4321F2F82388F995B7C9D8BE9D464284

Function 0110919E Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3de90e69ebaa4d3ad90bec9997d393c106c4f248cc288743c461ec8281bcc34
Instruction ID: 670561f4ddf5c40b83dc76ec4780ad4e6a3edbf3e8ae5cd75e80deed1f3f03ce
Opcode Fuzzy Hash: d3de90e69ebaa4d3ad90bec9997d393c106c4f248cc288743c461ec8281bcc34
Instruction Fuzzy Hash: 78B19CB3F106354BF3544978CD983626692AB95325F2F82788E8C7BBC9D87E5C0A53C4

Function 01027262 Relevance: .3, Instructions: 326COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7794a4de4ba2f3989902228e32b0b9ec20acb529cb3c16dcab9db55efdf978d0
Instruction ID: d0815a5346dc0b88e4f20816e4ee513a97daecd33aae33746c5c0088fa8dab29
Opcode Fuzzy Hash: 7794a4de4ba2f3989902228e32b0b9ec20acb529cb3c16dcab9db55efdf978d0
Instruction Fuzzy Hash: B5B147F7F516214BF3584875DD98362668397E0324F2F82398F69677C5ECBE5C0A4284

Function 010C81CE Relevance: .3, Instructions: 325COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2671f23807f1e3b7cb3084ffa485c65023b3b74473fb379243a582e940e3acdc
Instruction ID: eb252c283fcea65d37c1f34d0f6ff097c3a4d93d38be4272716fed04c18f97af
Opcode Fuzzy Hash: 2671f23807f1e3b7cb3084ffa485c65023b3b74473fb379243a582e940e3acdc
Instruction Fuzzy Hash: 0AB19CB3F116250BF3584839CD683A665839BE5324F2F82788E9DAB7C5D87E5D0A13C4

Function 0108601B Relevance: .3, Instructions: 325COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f046d9f319a484a432d217907e852949f9292630ec3b91a58707940b62f519a
Instruction ID: 46ecdb79c1aa0f21ce7d9058e180aa19f01e6a109ba3261e644f1d5d52569267
Opcode Fuzzy Hash: 6f046d9f319a484a432d217907e852949f9292630ec3b91a58707940b62f519a
Instruction Fuzzy Hash: 66B18CB3F116254BF3544969CC983A27693DBD4324F2F82788F48AB7C5D97EAC0A5384

Function 0109921B Relevance: .3, Instructions: 325COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e25575cc6713822f2fa41a0c52096be08f40e1a78ad7ed1db7e12e8c5d2c00a
Instruction ID: d3c806ac4aa55e8fc5f97eb6a99bfef39780779a2796d3539e09a5fcc3afc011
Opcode Fuzzy Hash: 9e25575cc6713822f2fa41a0c52096be08f40e1a78ad7ed1db7e12e8c5d2c00a
Instruction Fuzzy Hash: 3EB177B7F112214BF354493ACD583626683ABD5324F3F82788A9C6BBC5ED7E5C0A5384

Function 010B6257 Relevance: .3, Instructions: 325COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51374f1b9f2b2d9d782cfa8104feb04b8a961469cd94165d0513636b06c57590
Instruction ID: ef83f7c124833f2fd1316460fdd1b889ea73c76909b0df3998e641346e437426
Opcode Fuzzy Hash: 51374f1b9f2b2d9d782cfa8104feb04b8a961469cd94165d0513636b06c57590
Instruction Fuzzy Hash: 19B16DB7F1162507F3944879DD583666583DBD5321F2F82388E98ABBC9DC7E9D0A0384

Function 0107E514 Relevance: .3, Instructions: 325COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ef12e12180c349da5e9c84a5f7c5d08f7314e3391f003930a1d6801c1767628
Instruction ID: c7f56a75b2a5d56c899d8c1df77687e664dd2e510b336306ad6749b1fea3e5ac
Opcode Fuzzy Hash: 4ef12e12180c349da5e9c84a5f7c5d08f7314e3391f003930a1d6801c1767628
Instruction Fuzzy Hash: 56B18AB3F116204BF3488839DDA83666583ABD5325F2F82788F5DAB7C5DC3E5C0A4284

Function 0102E08D Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f4ddcb9e0a7b2581cb239ec66a81cbfa238f07e5a004e7b6cfe59b6aadd6812
Instruction ID: 874343e5dfec09b81ddbd2dfa976d89bf360752b7316b458231378c02aa7a462
Opcode Fuzzy Hash: 5f4ddcb9e0a7b2581cb239ec66a81cbfa238f07e5a004e7b6cfe59b6aadd6812
Instruction Fuzzy Hash: 24B158B3F116254BF3844979DC98362668397D5324F2F81388F5CAB7C6D8BE9D0A5388

Function 010B432A Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24f460180cf51fbb4f70f69cd1df91c1aa30173976796e8535126dc5134a15ba
Instruction ID: 8a3f8dba301c59f394880bc37dc4f6c74d7fe0e235d686157f44bce76c99d3ba
Opcode Fuzzy Hash: 24f460180cf51fbb4f70f69cd1df91c1aa30173976796e8535126dc5134a15ba
Instruction Fuzzy Hash: ADB18BB3F6052147F3980839CC593A66683EBD5324F2F82798E59AB7C5DC7E9D0A4384

Function 0112B209 Relevance: .3, Instructions: 318COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91bd97230348c98bce6f3de644f842f3eff83d1b34795de60fff6ba7eaf77c4f
Instruction ID: 76eec0c4f2081d9dab4682ec995354fb4822b4596b58795a585f7972ec1c6559
Opcode Fuzzy Hash: 91bd97230348c98bce6f3de644f842f3eff83d1b34795de60fff6ba7eaf77c4f
Instruction Fuzzy Hash: 1BB189B3F106214BF3584979DC983A6668397D4324F2F82388F59ABBC5DC7E5D0A4288

Function 0100720A Relevance: .3, Instructions: 317COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fec970495cb166a033325f2518fe3f3e62fd44c42a9135bd526a45aa81769e1
Instruction ID: 81f59ec71847809052e91e7705e33de48e42f7e6ff1b378e5a5424a43f08b38c
Opcode Fuzzy Hash: 3fec970495cb166a033325f2518fe3f3e62fd44c42a9135bd526a45aa81769e1
Instruction Fuzzy Hash: 69B1AEB3F512214BF3504D64DC983A27683EB94324F2F82788E986B7C5E9BE6D0643C4

Function 0104728D Relevance: .3, Instructions: 317COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e538fad81fe382ea98841d711f6f941fe46403831e2fc5e92a3bf5910baa0b7
Instruction ID: 64fbcf2f006520da1ef35e113e4923946d3e750d536c2c59dd008f1dd00434fb
Opcode Fuzzy Hash: 4e538fad81fe382ea98841d711f6f941fe46403831e2fc5e92a3bf5910baa0b7
Instruction Fuzzy Hash: 7DB1ABB3F112254BF3544D69DCA83A27283DBD5324F2F82788E886B7C5D87E6C095384

Function 01062312 Relevance: .3, Instructions: 316COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c8e09439c21f696f8f8e4e645690dfdfe88627eb966ed6c96bd6e9b277a3703
Instruction ID: 4499fdca2504306cdda2c6543378b6b5cf1a309cc9fa93ca1f3162c2a40a7e8b
Opcode Fuzzy Hash: 9c8e09439c21f696f8f8e4e645690dfdfe88627eb966ed6c96bd6e9b277a3703
Instruction Fuzzy Hash: 5FB19CB3F116254BF3444939CD683A66683ABD4314F2F81788E8DAB7C6DC7E5D0A5384

Function 0104B122 Relevance: .3, Instructions: 314COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6df9cd93091960c11c2dd98b203f3f677c198a17ad777227e51bd74ec65bbae5
Instruction ID: d05cb429ee9661ec0da935c300f18aab33a7af6fcd4b2e89e4f2d248b447d60d
Opcode Fuzzy Hash: 6df9cd93091960c11c2dd98b203f3f677c198a17ad777227e51bd74ec65bbae5
Instruction Fuzzy Hash: B1B18BB3F105244BF3544929DD983A26683EBD5324F2F82788E9CAB7C5EC7E5C095384

Function 010F5183 Relevance: .3, Instructions: 314COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6295899a9e6e3da44bfa15125da87b4eed5db049e1ff8d5e58c0b4a154b2e6cd
Instruction ID: fa85ea80753dd7c4cb49ea661f1e358460f251d2134c6c8e4d8b46c69adfec4f
Opcode Fuzzy Hash: 6295899a9e6e3da44bfa15125da87b4eed5db049e1ff8d5e58c0b4a154b2e6cd
Instruction Fuzzy Hash: F9B18CB3F1162147F3844969DC583A66683EBD5320F2F82788F98AB7C5DD7E9C0A4384

Function 01097191 Relevance: .3, Instructions: 313COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 688af08d1122f847b6f9064474283a1cee77e8358d2a0ce3343d0beecade0cb7
Instruction ID: e5fb621ecdff576ae190f7d13c335920ee98ea944596d58101b0cee1e7fa388d
Opcode Fuzzy Hash: 688af08d1122f847b6f9064474283a1cee77e8358d2a0ce3343d0beecade0cb7
Instruction Fuzzy Hash: 2CB190B3F126254BF7444929DC983A27683EBD5311F3FC2788A481B7C9DD7E680A9384

Function 00FEA3D1 Relevance: .3, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f5786960526ec56e3f2f8b0c35538efcfa30878f086e0d1341c876f7995d1fd
Instruction ID: 425a457fd18aeb4fcbc6214f0f52c5e9d167da8cb0a92f6816f022d24936e1fc
Opcode Fuzzy Hash: 9f5786960526ec56e3f2f8b0c35538efcfa30878f086e0d1341c876f7995d1fd
Instruction Fuzzy Hash: 21B1B9B7F612114BF3444D79CC983A27683EBD5314F2E82788A889B7C9DD7E9C0A5384

Function 010A8309 Relevance: .3, Instructions: 309COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5136e623df85a7c59b4b8a3b51c75c1de2f182998b18440d645890599d38f310
Instruction ID: 13e9f6fe2c6dba6f3943c2630cfca23417cf5a452942c02be222aa46ef80af70
Opcode Fuzzy Hash: 5136e623df85a7c59b4b8a3b51c75c1de2f182998b18440d645890599d38f310
Instruction Fuzzy Hash: 68A17BB7F106214BF3584878DDA83626683D794324F2F82398F996B7C6DC7E5C064384

Function 0111A1BC Relevance: .3, Instructions: 308COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8da3a4fab5e9b2e5593a1b69c058628fb4525a24b07fd7ab1bb40412b210bbc0
Instruction ID: ef8ba03210fde7f849bd61b87c0416ed32314bf8ecac36181b155ba2d2e660a8
Opcode Fuzzy Hash: 8da3a4fab5e9b2e5593a1b69c058628fb4525a24b07fd7ab1bb40412b210bbc0
Instruction Fuzzy Hash: 2BA19CF3F516250BF3584839DDA83A225839BD5325F2F82398B599B7CADC7E5C0A1384

Function 010452D1 Relevance: .3, Instructions: 304COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea7c968312b2758a471adc2e2493c91c79252ba53dd6546fa7e78e1fb49be219
Instruction ID: 7469d83dc71d0c01c156eaeff6e6179a53ee87bccc38a602cc221fe8fdbe09dd
Opcode Fuzzy Hash: ea7c968312b2758a471adc2e2493c91c79252ba53dd6546fa7e78e1fb49be219
Instruction Fuzzy Hash: 96A19CB3F112254BF3584939CDA83A62682DB94321F2F827C8F996B7C6DC7E5C095384

Function 010E9268 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a9b33526b0a2f4b00a0ba04833363b6f66d1f9df143695d6029627271eab797
Instruction ID: eece7574732fae3d2668b4a7daf110be7043836cf725c7ed053eb92a96c5e26c
Opcode Fuzzy Hash: 1a9b33526b0a2f4b00a0ba04833363b6f66d1f9df143695d6029627271eab797
Instruction Fuzzy Hash: FFA17AB3F116254BF3544969DC983626683ABD5324F2F82388F986B7C9DD7E9C0A4384

Function 010D0120 Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3e4d73749479edca8b2c08c59e565b37824a507edf5940a0105301bb02a5115
Instruction ID: f8492befe365177f2ad0c4bf27e74e2da7e32e954bb6a9a39fba3a66e8bf8127
Opcode Fuzzy Hash: a3e4d73749479edca8b2c08c59e565b37824a507edf5940a0105301bb02a5115
Instruction Fuzzy Hash: 61A18AF3F1162647F3584879DD583A2668397E0325F2F82788F59ABBC9DCBE5C064284

Function 0107A173 Relevance: .3, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 426833d28d12047bbbc1a10af4e0b7f1d8c1f63499d7701cdf552020c1825ad0
Instruction ID: 968c7cfe2cfb49abdeb4b7b7b7100bccf16d9ae4928f2fff9e6cdfe87f1f78bb
Opcode Fuzzy Hash: 426833d28d12047bbbc1a10af4e0b7f1d8c1f63499d7701cdf552020c1825ad0
Instruction Fuzzy Hash: B1A19DF3F106254BF3540D79CD983A66682A7A4321F2F82388E9C6BBC5D87E8D4953C4

Function 00FEF108 Relevance: .3, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12f4a5e391229cecddffc65d79723f3f25e8a2fc50faafa06662745cf9c7bb47
Instruction ID: c4e5c1b49c868f31de293e91e808f59e71925e87267684109531e66f3af78a25
Opcode Fuzzy Hash: 12f4a5e391229cecddffc65d79723f3f25e8a2fc50faafa06662745cf9c7bb47
Instruction Fuzzy Hash: 0AA18AB3F116254BF3144D79CC983A27643DBD5321F2F82788A58AB7C9D97E5C0A5388

Function 0102D1D9 Relevance: .3, Instructions: 299COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef74b2b257dc488a18fe19fc64fe320e49b609a66fcab08deea2334f2c77b682
Instruction ID: e0291ecb707664337efe0a07405bf76fa8d4cff09e7eba758c68107443d5398c
Opcode Fuzzy Hash: ef74b2b257dc488a18fe19fc64fe320e49b609a66fcab08deea2334f2c77b682
Instruction Fuzzy Hash: C7A189B3F006244BF3444969CC983B67693EBD5314F2F82788A896B7C5DD3E6C0A9784

Function 010243E5 Relevance: .3, Instructions: 299COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 400cc068c3424c9cdae8b2527aad6f05add43ff01e74ca9d69e33fd0c5889b24
Instruction ID: 5937c428059ca94c519ac3896ca2649bf744b7df767dce4403f9382ca5a073d5
Opcode Fuzzy Hash: 400cc068c3424c9cdae8b2527aad6f05add43ff01e74ca9d69e33fd0c5889b24
Instruction Fuzzy Hash: 0CA1DEB3F1162547F3444979DD983A6A6839BD1320F2F82788E5CAB7C5D9BE9C0643C4

Function 0110D048 Relevance: .3, Instructions: 297COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 726aa3a3dcd0889a8167e93749a00c0284820b3b4dbe2efdf1bdff27a00753f5
Instruction ID: 89e296f617b2b2bea686773a2a7b9fed8dc176bcbfd4f17dfa7e5afb1021fbb8
Opcode Fuzzy Hash: 726aa3a3dcd0889a8167e93749a00c0284820b3b4dbe2efdf1bdff27a00753f5
Instruction Fuzzy Hash: E3A18CF3F116244BF3544878DD583A26583D7E5321F2F82788E986BBCAD87E5D0A5384

Function 010C60BF Relevance: .3, Instructions: 297COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25621c6047a294b5294d72db7349581dae8c82dad1dfd100733a08d45bfe84ae
Instruction ID: aabcc1796d8d78050ade5c8d38dd39058a8aa6687cd9016a594e1dcf287f2214
Opcode Fuzzy Hash: 25621c6047a294b5294d72db7349581dae8c82dad1dfd100733a08d45bfe84ae
Instruction Fuzzy Hash: BAA19CB3F506200BF3544879DD993626583DB95324F2F82798E9DAB7C5DCBE5D0A0384

Function 0113D331 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43ff56031efe9fba6ad9e39898bd7ccfe5ad3d3f8808138b2eead9861ba8d2ca
Instruction ID: 6005f3867550ba0ba5d99742b4acb884f2ae91bfa6bc5091d3a3729c1052e27a
Opcode Fuzzy Hash: 43ff56031efe9fba6ad9e39898bd7ccfe5ad3d3f8808138b2eead9861ba8d2ca
Instruction Fuzzy Hash: 22A1B8B3F116254BF3544D78DC883A266939BD5321F2F82788E0C6BBCAD97E5D0A5384

Function 0107B352 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f192791c45263fba2d8df5f2c8f72694952267aff59393de6c9c9dd5fd6e6a9
Instruction ID: 4348be698b2b63daf21011dc66bb630777474a7aa26348191e6c189c87c1bdd6
Opcode Fuzzy Hash: 7f192791c45263fba2d8df5f2c8f72694952267aff59393de6c9c9dd5fd6e6a9
Instruction Fuzzy Hash: 24A168A3F116114BF3984D39CCA83766683EB95311F2F817C8E899B7C9DC7E690A5384

Function 010203BF Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 838e6abb78653451ad9e38159da2394c841b54acf23ea06f13dd5c908bf8bb81
Instruction ID: be1bb2428d7e03bbafc45013c5566222dbdb54232ef0210efa7e81d4bf3bb41a
Opcode Fuzzy Hash: 838e6abb78653451ad9e38159da2394c841b54acf23ea06f13dd5c908bf8bb81
Instruction Fuzzy Hash: EAA1ADB3F106254BF3544D68CC983A27682EB95320F2F82788F5CAB7C5D97E5D0A5788

Function 010B8274 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc9fc15f88ced70e114efa7ab72865e82b8897060ed153d4b0daca05795baf52
Instruction ID: d0331531de77aeafb89c71c631f50812e69e58e8cb774209f103187730ca3238
Opcode Fuzzy Hash: cc9fc15f88ced70e114efa7ab72865e82b8897060ed153d4b0daca05795baf52
Instruction Fuzzy Hash: 1FA1ACB3F216254BF3944938CD983A26642DB95324F2F82788E5CAB7C5DC7EAD0953C4

Function 010A2030 Relevance: .3, Instructions: 293COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df7beddfb5e74023187cdb32f454b587ed8c78f6f4b35abb932a3572e522587b
Instruction ID: c3a61fb5e6edd58c1f983cd5fbd45a5ef14dceef5bce1d867c56b419066bb980
Opcode Fuzzy Hash: df7beddfb5e74023187cdb32f454b587ed8c78f6f4b35abb932a3572e522587b
Instruction Fuzzy Hash: F5A169B3F102254BF3984D69CCA83622692EB95314F2F827C8E8D6B7C5D97E5C0A5384

Function 0102F143 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5566c62763065d134db7c2fc943a9a3ab27010538f70dfceeb5753f4e634ee31
Instruction ID: c18a06828a16e5ae2be5f7a4366dda48e2660250b27367d77132453d0bcec67f
Opcode Fuzzy Hash: 5566c62763065d134db7c2fc943a9a3ab27010538f70dfceeb5753f4e634ee31
Instruction Fuzzy Hash: 07A1BFB3F116254BF3444929CC583A26683D7D5325F2F82788E98ABBC9DC7E9C0A5384

Function 010A2501 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a17cc10cd0c5e9b7c15f79b799362a637d5e51570958ddc4bb0b18e10a7a4a7
Instruction ID: 90ed461db47673f06501da91a5e4ee55e7695e5e469902ed0f2b1dbe1c28fbdb
Opcode Fuzzy Hash: 2a17cc10cd0c5e9b7c15f79b799362a637d5e51570958ddc4bb0b18e10a7a4a7
Instruction Fuzzy Hash: 8BA17CB3F1063507F3544878CD983666692AB95321F2F82788E5DBBBC6D87E5C0A53C4

Function 0101A089 Relevance: .3, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc4b84895128b2910aa26defa3f152f16842f99296a8817a770614991ff00a2c
Instruction ID: 2f524676ad68204d0de7f461a151e3b4e3a67a800d4a77a7444936aa1958e0f9
Opcode Fuzzy Hash: fc4b84895128b2910aa26defa3f152f16842f99296a8817a770614991ff00a2c
Instruction Fuzzy Hash: 15A148F3E1162507F3944879CD9836266839BD5325F2F82788E5C6BBCAEC7E5C0A52C4

Function 00FF4349 Relevance: .3, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 867801f2be11aa4f4e40c5dbcc89b5970b2ebfe07c7a2079d6c32b3f30b0764a
Instruction ID: 31babfb266a4d793525e345fd8cef68986842a753fd2b956abaf17691632084a
Opcode Fuzzy Hash: 867801f2be11aa4f4e40c5dbcc89b5970b2ebfe07c7a2079d6c32b3f30b0764a
Instruction Fuzzy Hash: EAA175B3F102254BF3484939CD583A67693EBD4325F2F81388F496BBC9D97E6D0A5284

Function 010790D8 Relevance: .3, Instructions: 290COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b32d5e21d57109228b0d1a68a8e9b47093e24cd1a3a57d58596564f44449cf0
Instruction ID: 455d9ce4dfc78cdcc862c3621d0535a5728d087125f1cd853a91284d16183e33
Opcode Fuzzy Hash: 2b32d5e21d57109228b0d1a68a8e9b47093e24cd1a3a57d58596564f44449cf0
Instruction Fuzzy Hash: 2FA1D3B3F516254BF3444D78DC983A23A83DB95310F2F82788E585B7CAD8BE6D095384

Function 010D93AF Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e796b8762fbc329b9f24380de9403ffd1c41076ada6bebf2e616b9f0deb57ef3
Instruction ID: a8bb1b77b36e41e287996e5653f687217557e622625df28c4529656adce5ec33
Opcode Fuzzy Hash: e796b8762fbc329b9f24380de9403ffd1c41076ada6bebf2e616b9f0deb57ef3
Instruction Fuzzy Hash: 2EA18CF3F105244BF3584929DC583626683ABD1324F2F427C8A9DAB7C6D87E9C0A5388

Function 010AC140 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 809b0d68708c606755a2e254dad4778b39906444346d509fce7cba4e90f4fb8c
Instruction ID: 23eb25eb30875641e9dddb57396c79db2673680ad9d5c5be3897dc72f77915fb
Opcode Fuzzy Hash: 809b0d68708c606755a2e254dad4778b39906444346d509fce7cba4e90f4fb8c
Instruction Fuzzy Hash: 7DA16EB3F216254BF3544978CD983626582DBD5320F2F82788E9CAB7C5D8BE9D095384

Function 010143B7 Relevance: .3, Instructions: 286COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464f2ef4eb17227754d0eb14695ea25ffc7cf3f2520179dab30293e62dd82a1
Instruction ID: 90d31eaa64d95a2a4fcd06d9914762a89e96ff3e2cdb58398f5addf701e58b03
Opcode Fuzzy Hash: 4464f2ef4eb17227754d0eb14695ea25ffc7cf3f2520179dab30293e62dd82a1
Instruction Fuzzy Hash: 64A19BB3F112254BF3444A69DC983A27683EBC5311F2F82788F89AB7C5D97E5D0A5384

Function 0111B208 Relevance: .3, Instructions: 286COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 790628d2370ddf2cb960a52c820adf08b60a93fb899ab30edfe2b2fec23436ee
Instruction ID: dba0d15636e83f567a25149627dbcd1f7e54e29c2f99c455b83b63c7b0072213
Opcode Fuzzy Hash: 790628d2370ddf2cb960a52c820adf08b60a93fb899ab30edfe2b2fec23436ee
Instruction Fuzzy Hash: 8CA1AEB3E111258BF3148E29CC54362B793EBD5325F2F82788E886B7C8DA7E6D055384

Function 0102117D Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46eae4d65997d19ce881f2dea09131f744e7d1cf823f9f45455b39f40efc252b
Instruction ID: 81e932234a6e8be8230ab58e73429753afe2789c40428fc5aef0f31950c4e56e
Opcode Fuzzy Hash: 46eae4d65997d19ce881f2dea09131f744e7d1cf823f9f45455b39f40efc252b
Instruction Fuzzy Hash: 99A1D0F3F516254BF3840878CC983A66682D7D4325F2F82788F58ABBC5D87E9C0A5384

Function 010E1185 Relevance: .3, Instructions: 283COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee7038c840373dffc68814702a577a6ac43676de66aee8a04cceba0eb048b294
Instruction ID: 7fd935093cdab7f0599ec4d5517affef963d3403593e99978c452f97fd2c54e8
Opcode Fuzzy Hash: ee7038c840373dffc68814702a577a6ac43676de66aee8a04cceba0eb048b294
Instruction Fuzzy Hash: E0A17BB3F416244BF3144979CDA83626683DB95324F2F82788F4C6B7C9D87E5C0A5384

Function 0112C012 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 230bde030ebdae5f23d76c6be213ceb8fc3a01412b009ff9b2c03cfe6be8a19d
Instruction ID: 42046d6fe6da53c31e5e8ae51282415d0e410c052cc8b8a91accd9a9ac55063c
Opcode Fuzzy Hash: 230bde030ebdae5f23d76c6be213ceb8fc3a01412b009ff9b2c03cfe6be8a19d
Instruction Fuzzy Hash: C6A1CDB3F502254BF3484878DDA83662683DB95324F2F82788F996B7C6DC7E5D0A4384

Function 010F93C7 Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d9dd8eabcefac83bb7c587f62e809ab8dc345d15b563faf575c72a0f08f7524
Instruction ID: 509b51912169b3dd9527192e66b35d7835264cb3676a6a7d5503236252ebc058
Opcode Fuzzy Hash: 6d9dd8eabcefac83bb7c587f62e809ab8dc345d15b563faf575c72a0f08f7524
Instruction Fuzzy Hash: 6691AEB3E115244BF3544D68DC683A26683EBD0325F2F82788F986B7C5DC7E9C4A5384

Function 010EE306 Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acb1eaa12689946f460dd1e462879f6a3492d19a6c6b97353a98a51f4c335d73
Instruction ID: 578eb89ca81c8b23e26ad4ea12d35256e36b352831319ea3234029d6587f35f6
Opcode Fuzzy Hash: acb1eaa12689946f460dd1e462879f6a3492d19a6c6b97353a98a51f4c335d73
Instruction Fuzzy Hash: 3A919AB3F112244BF3944979CD98362668397D5320F2F82788E9CAB7C9DCBE5C0A4384

Function 0105C383 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81c0e2d5697d2353f649ffd1278da77ab8169e8ee15f782be83a692c02b06032
Instruction ID: fd205c4089548438634b4bd40ba85bcf934b89ee8f7e0811cc8f9bddeab73dac
Opcode Fuzzy Hash: 81c0e2d5697d2353f649ffd1278da77ab8169e8ee15f782be83a692c02b06032
Instruction Fuzzy Hash: 3E917FB7F516110BF3884878DD583666683E7D4315F2F82788E495BBCADD7E5C0A4384

Function 01069209 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5922294b9546fb338694e3b46544e95c5c6f189ec973cbc8dd3acb7a33f7bd1
Instruction ID: ae659707fc3c5ef15cd9df568901dfdca2f7447547818beff4df44149f6e95f4
Opcode Fuzzy Hash: a5922294b9546fb338694e3b46544e95c5c6f189ec973cbc8dd3acb7a33f7bd1
Instruction Fuzzy Hash: E8917BB3F2152147F3544839CC5936666839BD5324F2F82388F59ABBC5DD7E9C0A5384

Function 0103A3B7 Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a6bc2de0180011228737bbe7a8363f88bc7896a9bf050073b1d2748f0be9239
Instruction ID: ce519a88b9247eb4ce0866a849042bf6c48b266cc9a41953c4bd9c0ce480c889
Opcode Fuzzy Hash: 1a6bc2de0180011228737bbe7a8363f88bc7896a9bf050073b1d2748f0be9239
Instruction Fuzzy Hash: DAA1BCB3F516254BF3544D68DC983A27692EB94320F2F42788F4CAB3C5E97E9D099384

Function 010891E8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 796e5c3e666584e96170fc10d234c44d4db84f03e877a20713dc3673acb0aac4
Instruction ID: 79721bf7e3edbd3d086f6ba5a33b511bbb43bad2fb4028fc30321689d933bc52
Opcode Fuzzy Hash: 796e5c3e666584e96170fc10d234c44d4db84f03e877a20713dc3673acb0aac4
Instruction Fuzzy Hash: E591CDB7F1022647F3540878DD683626682DBD5314F2F82788F5CABBCAE87E5C0A5384

Function 010BA2BC Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7646d5c6ace46e6186ade2e20373a8afb2d92f5c3acddf067406329e82130799
Instruction ID: 4facf2a0bc8f9bb733709ba102e766d1096037e69ce4448b2f2bf99cbe384f4b
Opcode Fuzzy Hash: 7646d5c6ace46e6186ade2e20373a8afb2d92f5c3acddf067406329e82130799
Instruction Fuzzy Hash: 6D91BBB3F506244BF3540969CCA83A27683EBD5324F2F8278CE486B7C5D97E6D0A5384

Function 01032155 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0eb57e477023e6130849e3226a7a63b76c900771796aba0c842c6e54ecc2f54e
Instruction ID: 903f3ff34c30da0de51906e7c9bc7bb5915fc9a4266cc56cc8c7b081d81f4bac
Opcode Fuzzy Hash: 0eb57e477023e6130849e3226a7a63b76c900771796aba0c842c6e54ecc2f54e
Instruction Fuzzy Hash: D591ABB3F1022687F3144D69CC98362B6839B95321F3F82798E982B7C5D97E6D0553C4

Function 00FF006B Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c8ef49faacd32614854d74fd4ddde4b999f8a70887b6198a436b86d9946c7ee
Instruction ID: 26c2c94362277fa9eda22bef615d14fcc1b8263eda19024a88e8ca6fe4ce399f
Opcode Fuzzy Hash: 3c8ef49faacd32614854d74fd4ddde4b999f8a70887b6198a436b86d9946c7ee
Instruction Fuzzy Hash: C8917DB3F116294BF3504D78CC983A276829B95320F2F82788E9CAB3C5E97E5D0957C4

Function 010E8001 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08d7a870d322603fed945213ea6172250cae8c7b74d8861d53b087974071e71c
Instruction ID: d3fc865a7c6bf2673b5fa5bd2ec9bda7c37c67a1f678456c5d32ee1fd6c210e5
Opcode Fuzzy Hash: 08d7a870d322603fed945213ea6172250cae8c7b74d8861d53b087974071e71c
Instruction Fuzzy Hash: 4291A9B3F115254BF3484D29CC983B16683ABD1324F2F827D8A892B7C5DC7E6D0A9384

Function 0112137A Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a2d644f70dac44395d4188d286ba44f9e31f671c89cd0a3101be5925f8dee0f
Instruction ID: 72bd751dc679600aa25870284cc345410e86808296e7f0b3d204aea85db160c5
Opcode Fuzzy Hash: 7a2d644f70dac44395d4188d286ba44f9e31f671c89cd0a3101be5925f8dee0f
Instruction Fuzzy Hash: 3E916CF7F21A250BF3544838DD583666582D7A5325F2F82788F98AB7C9D87E9D0A03C4

Function 0110E3BF Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ef9c7038518b20f0235f38e0c31d3e18a6bd138deca5d4be06887bdff2bc207
Instruction ID: f7e6557aa17b8c031b6d8cbb9d902650a61bf993e1ffa238a06684bca05b6257
Opcode Fuzzy Hash: 0ef9c7038518b20f0235f38e0c31d3e18a6bd138deca5d4be06887bdff2bc207
Instruction Fuzzy Hash: BE91ACB3F112254BF3444968CCA83A67643DBD5321F2F82388E596BBC6DD7E6D065384

Function 0111921D Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4258391d6263b7baf98fdec15854eb93ad2b18a7d6a98a8401e6ba4287695979
Instruction ID: b92f494a059098cd757ef83c2aef562763a4b90bcdd966839c093b78d3764a43
Opcode Fuzzy Hash: 4258391d6263b7baf98fdec15854eb93ad2b18a7d6a98a8401e6ba4287695979
Instruction Fuzzy Hash: FA917BB7E116254BF3944D28DCA83A27643EBA4314F3F81388E896B7C5E93EAD055784

Function 010251E7 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2894f907195401b0d09d758fe3e12e89cbfc2a67598641132c63de0f2bdabe3
Instruction ID: b3f7f17c9235ac1c2f2c63f84b7328db4844359de562c354174f78e36b33b115
Opcode Fuzzy Hash: a2894f907195401b0d09d758fe3e12e89cbfc2a67598641132c63de0f2bdabe3
Instruction Fuzzy Hash: 87916DB3F126254BF3544939CC983A26683D7D4325F2F82788E986BBC9D97E5D0A43C4

Function 0106E068 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ffabb33e0e041961482f92445a47107aa604b45dc0365a85643d7c5cc1e21cb
Instruction ID: e9084dc45473d5e61e3ac0c8cd80e96f7ae14d67fc8029427fe76b0ba7a7f81a
Opcode Fuzzy Hash: 7ffabb33e0e041961482f92445a47107aa604b45dc0365a85643d7c5cc1e21cb
Instruction Fuzzy Hash: 2D919DB3F115258BF3504D69CC943A2B292EBA5321F2F42798E8C6B3C5D97E6D0953C4

Function 010310A7 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f288e2172e47fc7388e4a9ad14372fe389a17f088b3a3537de9468eec90c1e2f
Instruction ID: bf60c0056897f2e7f98a3b55e74fd57572110ac8012ed02a5bf186bb651f25d1
Opcode Fuzzy Hash: f288e2172e47fc7388e4a9ad14372fe389a17f088b3a3537de9468eec90c1e2f
Instruction Fuzzy Hash: 8D91CEB3F116254BF3544928CC583A27693DBD5325F2F82788E4CAB7C9D97E5C4A4388

Function 0113920A Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1845c4d869a4cf4b8b47f9caea2e276dda23287f477d424c2b58dfa7416b8daf
Instruction ID: 8829d2c4a808ced5eb15b4a98b91af8de82583874a390df78e911ab136d4fab7
Opcode Fuzzy Hash: 1845c4d869a4cf4b8b47f9caea2e276dda23287f477d424c2b58dfa7416b8daf
Instruction Fuzzy Hash: E991ADB3F106254BF3440D29CCA43A27293EBD5315F2F81788A89AB7C5E97E9C4A5384

Function 0104E225 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d590bd7af931209b01914c588f438484e19d12a87ac1ae840a967615d54bd18d
Instruction ID: 93b43dceb487e8011e544d8c4634babb3d025783eda95382ceb4af61b38a5ca7
Opcode Fuzzy Hash: d590bd7af931209b01914c588f438484e19d12a87ac1ae840a967615d54bd18d
Instruction Fuzzy Hash: 679137B7F2152147F3984838CC69362658397E5325F2F82788E9DAB7C9EC7E5C0A5384

Function 0107822D Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03ef152f30db62c7be8bb52be6e60c37d998a9e49715938d6df92388447a76f3
Instruction ID: b1a8e66064a128b0c9c8e38fd052296dafe6248281086e24fd70c56b497043ff
Opcode Fuzzy Hash: 03ef152f30db62c7be8bb52be6e60c37d998a9e49715938d6df92388447a76f3
Instruction Fuzzy Hash: 9A918BB3F116254BF3484939CC583A63693DBD5311F2F82388E49AB7C9D97EAD0A5384

Function 010FD111 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88bf6c3f5c1f2253fc1948724ae13b8542e23e0ef0129abcaf284f4782105dbb
Instruction ID: 24c692077ea288b3abdac66b66ad734d70ff04fd5438c00b1080038894426391
Opcode Fuzzy Hash: 88bf6c3f5c1f2253fc1948724ae13b8542e23e0ef0129abcaf284f4782105dbb
Instruction Fuzzy Hash: 3F918BB7F116254BF3484879DC6836666839BD4325F2F82388F596BBCADC7E5C0A1384

Function 0105A124 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64e95f237fc4f37bef70df1f42b3e143318986673680e3feb514b8767dfe0388
Instruction ID: 48ad516f3933282d9a03202eb7510b97407dac09446f33b62cd394c1f261aaa6
Opcode Fuzzy Hash: 64e95f237fc4f37bef70df1f42b3e143318986673680e3feb514b8767dfe0388
Instruction Fuzzy Hash: DB9187B3F2152547F3484928DC683B67682EB95310F2F81788F8DAB7C5D87E9D0A5388

Function 0108034D Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c456f8b2ae24dc446b2dcb3e9f50b1ff00c867c819e8b20b3afb3923e9c6cbd
Instruction ID: 42d3d1b930dfbd4cf26bcd278e3c6b3c9fe46641397508e8dccf89f0c488624e
Opcode Fuzzy Hash: 9c456f8b2ae24dc446b2dcb3e9f50b1ff00c867c819e8b20b3afb3923e9c6cbd
Instruction Fuzzy Hash: 08919AB3F116254BF3504D39DC983A27683ABD8324F2F42788E886B7C5D97E5D0A9784

Function 0101C0EA Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 916d32289e225cada51ecd002328513a5f0bebac1709b3dc215632b798ef1089
Instruction ID: d92b6d6ed0dfc43595d3178f5b407d3e37f70ffe7b387c770ed892ce8beffae5
Opcode Fuzzy Hash: 916d32289e225cada51ecd002328513a5f0bebac1709b3dc215632b798ef1089
Instruction Fuzzy Hash: C791DEF3F116244BF3540968DD9836166839BD5325F2F82B88F8C6BBC9D87E5C0A4388

Function 0108F1E0 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 534bdcde9dc8c1c39cf98439f2de56523b59f9fc0b235b4ddffaaa08a22b3b08
Instruction ID: 0e9cec357a6d7beb07f87e593b644adb679f47355eb5b73eab9407c3c8602067
Opcode Fuzzy Hash: 534bdcde9dc8c1c39cf98439f2de56523b59f9fc0b235b4ddffaaa08a22b3b08
Instruction Fuzzy Hash: 5D9190F7F106244BF3544968CCA83A63683D791325F2F81788E896B7C5D97E6C0A5384

Function 01039354 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc460ce4e83d2a9314c07ec6c07e180b7d02cfe68567da821f76a19236540af7
Instruction ID: 53f020db8b67e31be33ba8cb5bdd1e2cb8043c2b4563272e42542d5604c273f1
Opcode Fuzzy Hash: dc460ce4e83d2a9314c07ec6c07e180b7d02cfe68567da821f76a19236540af7
Instruction Fuzzy Hash: 7791CDB3F1122587F3540969DC583A272839BD5324F2F82788E5C6B7C5E97E6C4643C4

Function 011003C9 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a137a89925a3dde42851d59dde41f1c6ac83c65b7ed70c9a679d544c733b9fce
Instruction ID: 480eb01cf01a0a13dc76b40aea37e75af95ed0c2716a680062b9debd2821b116
Opcode Fuzzy Hash: a137a89925a3dde42851d59dde41f1c6ac83c65b7ed70c9a679d544c733b9fce
Instruction Fuzzy Hash: 0991A8B3F105254BF3544929CC983A2B683ABD5320F2F82788E9D6B7C9DD7E5D0A5384

Function 01072282 Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83ac6f407af9732ae360a5c6fac45d0be149833f2ac27813c75dc1c65623770e
Instruction ID: 285c82147ad005eecbe9e8b47562b2684c109fe2ea6c6bf4423d6575f3c1b1a5
Opcode Fuzzy Hash: 83ac6f407af9732ae360a5c6fac45d0be149833f2ac27813c75dc1c65623770e
Instruction Fuzzy Hash: 3B91CEB3F116254BF3A00968DC583A2A682DB95321F2F82788E9C6B7C6D87E5C0953C4

Function 010A328F Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8d3c58916117ed270efa11e222aee8a8a076120f6f4a1863a612ad2922dd2fb
Instruction ID: ea868e6ca92f4f339489cebfd209d6d734423bed5ed534793f4c4dab1f5e8768
Opcode Fuzzy Hash: e8d3c58916117ed270efa11e222aee8a8a076120f6f4a1863a612ad2922dd2fb
Instruction Fuzzy Hash: 8E91BEB3F116254BF3844D68CC993A27683EBD5314F2F82788A199B7C5DD7EAC0A5384

Function 0111010A Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fe983be71c755fcd166f1966318fdc20d2b790d03802b5d9674a06229791dcd
Instruction ID: 44a0127ceda18701e1bc16355af7dca30cf83360f2ad5f0d635c0f1902202173
Opcode Fuzzy Hash: 8fe983be71c755fcd166f1966318fdc20d2b790d03802b5d9674a06229791dcd
Instruction Fuzzy Hash: 5C9168F3F1152547F3444969CCA83A26543E7D4325F2F81788F8DAB7C6E87E9D0A5284

Function 010D2071 Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5c03c94ec011ad8040312780c02d13dc6b9eff62706c2c518b203755f46b4e8
Instruction ID: 2e06a504e096f5480bf6149996fd2d02bfe935beb6312f1e3a9f2548b11d072d
Opcode Fuzzy Hash: a5c03c94ec011ad8040312780c02d13dc6b9eff62706c2c518b203755f46b4e8
Instruction Fuzzy Hash: 4D91ABB3F106214BF3584879DC983626283EBD5321F2F827C8E59AB7C9D97E5D0A5284

Function 010EB0DB Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d126a849b83600a9ab88606d4b35f90c1d9c37d4d205a7786531320c9005a7e
Instruction ID: cfa9673db3c5c3cf520bb1ad1eaeb22235e1069729adc62ddc5f63b3b37db366
Opcode Fuzzy Hash: 0d126a849b83600a9ab88606d4b35f90c1d9c37d4d205a7786531320c9005a7e
Instruction Fuzzy Hash: B291ADF7F106214BF3444D79CD983626682DB95324F2F82388F59ABBD9D87E9C0A5384

Function 0103B0E8 Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 663fd49a088918f6c2b9126f247afa10bcc9f4f1a93bbd6ee906e51f64cf7073
Instruction ID: 277743042763b63b63f11395b52b3b280ac305d81e3468a70c3a7602a0384388
Opcode Fuzzy Hash: 663fd49a088918f6c2b9126f247afa10bcc9f4f1a93bbd6ee906e51f64cf7073
Instruction Fuzzy Hash: 3B91CFB3F1162147F3444969DC983A27683DBC9324F2F82788B5CAB7C5D97E9C465384

Function 011343A9 Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18c6b97d6b8a9fccb8e16d03126d0cf5c7d99cbd4134d0f3723c7fa2596a711e
Instruction ID: 720361097278d314ec91edea258f973e70f5f135f153fccbf6bd3c3b23100b70
Opcode Fuzzy Hash: 18c6b97d6b8a9fccb8e16d03126d0cf5c7d99cbd4134d0f3723c7fa2596a711e
Instruction Fuzzy Hash: E2919DF3F506254BF3584879CD99366A6839BE0324F2F42398F5DAB7C5E97E5C060284

Function 01009211 Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f81c6a34bf21648d263672e28bcaaf063eafaac06df3a43680221953ff4536de
Instruction ID: a7eb089ff627f82ea7d01bb08d8a94b2d1e673221c92328f0a6f2ae01958f9a9
Opcode Fuzzy Hash: f81c6a34bf21648d263672e28bcaaf063eafaac06df3a43680221953ff4536de
Instruction Fuzzy Hash: 2E919DB3F4123547F3544879CC98362B6929B95324F2F82788E9CAB7C5E8BE5C0A43C4

Function 010BB07F Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fffb6e9f3b1c7a717ef186860a478a55f4174e64dce42301cd1c683d38a99b02
Instruction ID: c3b918d386556578cf5f30d2b02fceeadede8e0d73273fcc8681d1ae3a105e6a
Opcode Fuzzy Hash: fffb6e9f3b1c7a717ef186860a478a55f4174e64dce42301cd1c683d38a99b02
Instruction Fuzzy Hash: 12916DB3F516264BF3584864CC693A26283DBD5321F3F82388F19AB7C5D9BE9D461384

Function 00FED157 Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8be7cd8bb192ae28c3a8004a5869bc9723b5b05e67a4c004707a5b27b2053cec
Instruction ID: 250f599cbace95038b141240cfa23f04f33ca078e07d76578be2b04b988ae236
Opcode Fuzzy Hash: 8be7cd8bb192ae28c3a8004a5869bc9723b5b05e67a4c004707a5b27b2053cec
Instruction Fuzzy Hash: DF91AFB3F116254BF3544D69CC583A27282DBD4325F2F82388E98AB7C5ED7E9C495384

Function 010FB3A4 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54f3c67ed0901390ac71b10ca342529cd215bd813d54cec4d42f53d9ae3fbfc4
Instruction ID: 345ce05f3bc00309d4c7c22a16f938593f755ba1d16c3045f89704a601a723bc
Opcode Fuzzy Hash: 54f3c67ed0901390ac71b10ca342529cd215bd813d54cec4d42f53d9ae3fbfc4
Instruction Fuzzy Hash: 3891C0F3F5162547F3544875DC983A265839BD4324F2F82788EACABBC5D87E8C0A5384

Function 0109B066 Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f1d15ea2eadcf1db2e70b4e6b8d8d46a72072fdc3f888606d766793ae51bbe4
Instruction ID: fb4565a31050debb26eaaaaae59ba2d91fe89825ae7dbe14e4e26f1b00a42078
Opcode Fuzzy Hash: 4f1d15ea2eadcf1db2e70b4e6b8d8d46a72072fdc3f888606d766793ae51bbe4
Instruction Fuzzy Hash: 11918AB3F016254BF3144D69CC683B67283DBD5321F2F82788B896B7C4E97E6C465284

Function 010363D8 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 515552bfa37ba2d6d3e4b7c8936ef5f7cd179594877f3f0157dc7e5f6a5a722a
Instruction ID: ef4a013b3a991dfc433d870ec18072ce3f6fe8399b6fd842421e0b9329a8c7fd
Opcode Fuzzy Hash: 515552bfa37ba2d6d3e4b7c8936ef5f7cd179594877f3f0157dc7e5f6a5a722a
Instruction Fuzzy Hash: AC919DB3F116254BF3544968CC983A2768397D4325F2F82788E5C6B7C9E97E5C0A13C4

Function 010422C1 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 231459b6cf3b8e6c6a0ea41853343425f9819d35655f8a1f5bfddd0b416d8a0c
Instruction ID: 65d3cbfbc2deb937df0f3d59c1ceccb716cdaa24c13f355760eb83641bb9aa4d
Opcode Fuzzy Hash: 231459b6cf3b8e6c6a0ea41853343425f9819d35655f8a1f5bfddd0b416d8a0c
Instruction Fuzzy Hash: EA91CCB3F112254BF3444978CCA83A27693DB95325F2F82788E586BBC9D87E6D0953C4

Function 010680C1 Relevance: .3, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9493c330da4325bfcaf1f0baeb7025119e3d7339cb11ad8af1c6208104c994ec
Instruction ID: dab7ffc1f5567d204bb8ab1085317232a3382d69e8e6a5b0b3ae9eee4a63dc6f
Opcode Fuzzy Hash: 9493c330da4325bfcaf1f0baeb7025119e3d7339cb11ad8af1c6208104c994ec
Instruction Fuzzy Hash: 48918CF3F115204BF3484929CC593A62183D7D5325F2F82788E59AB7C9DD7E9C0A5384

Function 010D80E6 Relevance: .3, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 829bdbe1591d421d3916e62aabab79936ab6c2592d3b1770414309d1951a3e52
Instruction ID: c66073e79d7656020c07595edb212aeea3ee0515eeb52eb35211391ec24fc72c
Opcode Fuzzy Hash: 829bdbe1591d421d3916e62aabab79936ab6c2592d3b1770414309d1951a3e52
Instruction Fuzzy Hash: 54918BB3F115248BF3504E29CC943A27293EBD5321F2F82798A885B3C4DD7E6C0A9784

Function 01122087 Relevance: .3, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17c70a4c717686555b0646634941d3a573d98ac5122e3e2e60bc232532d8da22
Instruction ID: 08a9d2a0dbadc48ca5283d04b46416b85860b3b6a63a359579ca125c5b77fe95
Opcode Fuzzy Hash: 17c70a4c717686555b0646634941d3a573d98ac5122e3e2e60bc232532d8da22
Instruction Fuzzy Hash: F79187B3F116204BF3584939CD583626683ABD4324F2F82788F9DABBC5DD7E5C0A5284

Function 00FF8137 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b64d263faa317045a0560d4106c1d3f07a2fbe7621e88134145a6f43b6a29e1
Instruction ID: 56ce3b0c279ad2d2ad3ef5b87481ce6496dfa903e34963f8c1337d79cf55362f
Opcode Fuzzy Hash: 6b64d263faa317045a0560d4106c1d3f07a2fbe7621e88134145a6f43b6a29e1
Instruction Fuzzy Hash: 8D916A73F102254BF3504E69CC583A27693ABD4320F2F81788E886B7C5D97E6D0A97C4

Function 010CE3CA Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df613757ecf11071bc20978d48447827b2496075c0b8790feed166c96f8b2772
Instruction ID: a4616bdd583498a386d533d212e675c1225e1032fa90dd8ca90680b2c9a8fd13
Opcode Fuzzy Hash: df613757ecf11071bc20978d48447827b2496075c0b8790feed166c96f8b2772
Instruction Fuzzy Hash: 6191ACB3E115254BF3444E68CC943B2B392EB95311F2F817C8E89AB7C4D97E6D095784

Function 010DE3D0 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91a4fa3a5c31fce11301ff5956c30c92597d5b2026606e40ad5f6c67dc43508b
Instruction ID: 6836f72f2f5f603308ab0969a8dce0ac35f357bf929bec0cdceff2326b544453
Opcode Fuzzy Hash: 91a4fa3a5c31fce11301ff5956c30c92597d5b2026606e40ad5f6c67dc43508b
Instruction Fuzzy Hash: A38168B3F002244BF3548979DC9436276929B95321F2F82788E9D6BBC9E97E5C0A53C4

Function 0101D1F9 Relevance: .3, Instructions: 253COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9822a420f9f0836f8c93a72702cce3b7df56dc00ddf6064cc78c0a570ef05c18
Instruction ID: 0d5903c2c761feb77969c22072f3317997efe870bcd8a8c926ec3592a716551b
Opcode Fuzzy Hash: 9822a420f9f0836f8c93a72702cce3b7df56dc00ddf6064cc78c0a570ef05c18
Instruction Fuzzy Hash: B48147B7F125244BF3504E29CC583626693ABD5324F2F86B88E8C6B3C5D97E6D0A53C4

Function 010EA0F7 Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bcdf1b6e6284d7fe14ad7f8dc88274b5e2ddb1314bb35d7929917623dff163f
Instruction ID: 8e11485b30bd9631c918bb801bf5e8339f2a03dd55f679842f03842a0903e27b
Opcode Fuzzy Hash: 1bcdf1b6e6284d7fe14ad7f8dc88274b5e2ddb1314bb35d7929917623dff163f
Instruction Fuzzy Hash: 71816BB3F215210BF3584839CDA93A665839BD5324F2F82788F5DA7BC5DC7E5C0A5284

Function 00FFB35B Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2a370fe5972735b0ff12feffb0a72f207d3a1622264086413ea6e3f4d9712aa
Instruction ID: a53d7216dbbcdfcda64c57f55e8fcb8ee34b3a8304d12ffade7a12c9184dff05
Opcode Fuzzy Hash: b2a370fe5972735b0ff12feffb0a72f207d3a1622264086413ea6e3f4d9712aa
Instruction Fuzzy Hash: F8917AB3F111248BF3444D68CD683A27692EB95320F2F82788A996B7C4D97F9D095384

Function 0110A3C6 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8c69f7ab2a83841bd9036ab86ab9459c027207a6b64c2ec90d105a0b906462d
Instruction ID: 12281bce812af431b23b83517ea0e5b664b839c0e1d36f5c152c6658062bcb17
Opcode Fuzzy Hash: e8c69f7ab2a83841bd9036ab86ab9459c027207a6b64c2ec90d105a0b906462d
Instruction Fuzzy Hash: A591BDB3F112254BF3544E29DC983A17793ABD5320F2F42788E986B7C1D97E6D095384

Function 0109C3E8 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6276f796b60e25e5bf2985d24980804e0ce8527cfcd3cdc99e2a0ef84f046e8
Instruction ID: 8942cbf97abd6f1a4beefa21b9f2c58a0e0894776b5d0fb1b3c6012e17d7dbb3
Opcode Fuzzy Hash: a6276f796b60e25e5bf2985d24980804e0ce8527cfcd3cdc99e2a0ef84f046e8
Instruction Fuzzy Hash: 88819DB3F116254BF3544929CD983A27683DBD4315F2F81388A8897BC9DD7E6D0A5384

Function 0100235E Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fff0d43d6b74731ba1349dd3fe81b04ad524638ac06406efa19cff3980e759f2
Instruction ID: 2305aa443797143dc2f4d4bcf9b5ce99f859bec48be50bd044e4956f155a039d
Opcode Fuzzy Hash: fff0d43d6b74731ba1349dd3fe81b04ad524638ac06406efa19cff3980e759f2
Instruction Fuzzy Hash: 2791C2B3F112248BF3904E69DC983667292EB95310F2F81788F886B7C5DD7E6D099384

Function 01117146 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 919245ef5bf7d30f951f7de3680e1b63574ce14d8d0afdcea9242e297cff5d31
Instruction ID: a50f8b8e22564ba6fecc752b3bd047d078193128f3a2b100b24af8ca726cb10e
Opcode Fuzzy Hash: 919245ef5bf7d30f951f7de3680e1b63574ce14d8d0afdcea9242e297cff5d31
Instruction Fuzzy Hash: AA81CCB3F2062547F3944978CD983626682DB94314F2F82788F4DAB7C9D87E5C0A53C4

Function 0109C00C Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88f15ae1a6c3abdafa3789ac65998d89e3ebc529583b0cca1697e1a1063ef305
Instruction ID: f76604001af6138cf1dc0988fd3384785e815c2be4345fb132e7b7d1eff37d16
Opcode Fuzzy Hash: 88f15ae1a6c3abdafa3789ac65998d89e3ebc529583b0cca1697e1a1063ef305
Instruction Fuzzy Hash: 0E818DB3F2062047F3588938CC693A67682DB95325F2F827C8F49AB7C9D97E6C055384

Function 010810DF Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce276dc8d906e328d9ab30eb3391b2be14662f10edee0b3e3b30e6daef8c0985
Instruction ID: 1c478a798b1aa19d6e9457ba25db5860a7ad8d10991cee682a5c3327ff61edff
Opcode Fuzzy Hash: ce276dc8d906e328d9ab30eb3391b2be14662f10edee0b3e3b30e6daef8c0985
Instruction Fuzzy Hash: 1D818AB3F115254BF3484929DC583A66683EB90325F2F81388F4DAB7C5DD7E9C0A9788

Function 010E7367 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 706f464344102b05c1629fc4cc9095ad5086acfcf19a016aed04176252721a41
Instruction ID: 00393f78a9ae6e5264f9ba5aa7266d0fe23fdc19dea03bc080772ca97bbcae63
Opcode Fuzzy Hash: 706f464344102b05c1629fc4cc9095ad5086acfcf19a016aed04176252721a41
Instruction Fuzzy Hash: 8D818AF3F116254BF3444D29DC983A23693DBE5311F2F41788A489B7C9E97EAC0A9784

Function 0106A152 Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e854ae1bd49ef6161f03dda359c0f97c67920fd7e4bd7ee061998f0142659794
Instruction ID: 92d8c79c671fbf8f3cecc0f9497c4d4d19f349c8bebc411f4cc89d154e5ca0d8
Opcode Fuzzy Hash: e854ae1bd49ef6161f03dda359c0f97c67920fd7e4bd7ee061998f0142659794
Instruction Fuzzy Hash: 4881ACB3F11A254BF3544D29CC983617693EBA5321F2F82788E9C6B3C5D97E6C0A5384

Function 0104D35D Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26611f18c47ac0a1724b62b7f0e237aad09a3ad954972e8b022122043a48a647
Instruction ID: 1c266d962469351bf5fb02321ecbd0111cec55c9dabf40b64205fec7a2a7946c
Opcode Fuzzy Hash: 26611f18c47ac0a1724b62b7f0e237aad09a3ad954972e8b022122043a48a647
Instruction Fuzzy Hash: 3A817BB3F101254BF3544D79DC983627683EB95314F2F82788A88AB7C9DD7E6D0A5384

Function 00FFA36D Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42acdb563cb45898a91da3c348f5f2a34d87daaf82d65680b5a9441b5cb73d0c
Instruction ID: b05ff295ab793a4d7dbfc36cb4779ba5015b0d6a55be2cc6cb9b521f1cf64512
Opcode Fuzzy Hash: 42acdb563cb45898a91da3c348f5f2a34d87daaf82d65680b5a9441b5cb73d0c
Instruction Fuzzy Hash: 6D818CF3F116254BF3044A68CCA83A27693EBD5321F2F41388A4D6B7C1E97E9D069384

Function 00FF3367 Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd66c416cf82b578fa4d5a1def2b6f94b89b563efbd0c1eadc599c1d32d0c2b4
Instruction ID: f44199f912da2830b81fa0be7e37c52d3ce156890547ccac48800125da139744
Opcode Fuzzy Hash: cd66c416cf82b578fa4d5a1def2b6f94b89b563efbd0c1eadc599c1d32d0c2b4
Instruction Fuzzy Hash: 6D818AB3F416214BF3444969DC983A27683EBD5321F2F81388F58AB7C9D9BE5D0A4384

Function 0106711A Relevance: .2, Instructions: 245COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70f2fca175e9e08861e637fdc035b32fc1ed1601f07f187782793d2dbb688486
Instruction ID: 6800faea3e244680b95059962385e13d52fa06815574e70a6853eed335f616d8
Opcode Fuzzy Hash: 70f2fca175e9e08861e637fdc035b32fc1ed1601f07f187782793d2dbb688486
Instruction Fuzzy Hash: CD8189B3F1262547F3544939CD683622693A7D5321F2F82788EAC6B7C9DC7E5D0A4388

Function 0110104F Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bc4517dff2357346a5abda14ac0e65857f7b295d874b1146c6377a5cd7e654e
Instruction ID: aaf4dddc30a5f261590468f993f708fa4a38e79a21609ffc0abdfd1517a1894c
Opcode Fuzzy Hash: 7bc4517dff2357346a5abda14ac0e65857f7b295d874b1146c6377a5cd7e654e
Instruction Fuzzy Hash: BC81A7F7F106204BF3484969DCA83726683AB99315F2F82788E8D6B7C5DD7E5C095384

Function 010433A4 Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f411d3f97007fe85cbae7a646c4ffb8fa40b6b51184e20e614360f24ada07ec
Instruction ID: d2a73f308a000365a3b4f216fb8a8774f2a03951c06b4696fd1e1a9d4b3fd3b1
Opcode Fuzzy Hash: 9f411d3f97007fe85cbae7a646c4ffb8fa40b6b51184e20e614360f24ada07ec
Instruction Fuzzy Hash: 988189B3F115354BF3540968CC683A26293AB91325F2F82788E5CAB7C6DD7E9C0953C4

Function 00FE806C Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a257726f9db0d2ea90ea616119a0670b49cd7983624b66394bddc967baa9295a
Instruction ID: 95fcdc0bc54f4f7b09ba2c061108ace068ca04357b483247e31b0ede0341de26
Opcode Fuzzy Hash: a257726f9db0d2ea90ea616119a0670b49cd7983624b66394bddc967baa9295a
Instruction Fuzzy Hash: 50819AB3F116214BF3544D69CC983A2B693EBD4324F2F81788E886B7C5D97E9C0A5784

Function 010AD3E4 Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8780dbec9135493141ef434fa729b90ba4d9c4529c318e3da6fa5c042e5f076
Instruction ID: e9c17519a017ce86b5d517198a4bd181046997a46f3d8d305c95255df96c4ab5
Opcode Fuzzy Hash: e8780dbec9135493141ef434fa729b90ba4d9c4529c318e3da6fa5c042e5f076
Instruction Fuzzy Hash: B0816BF7E1162107F3584C29DC993626282EBA0325F2F823C8F99A77C5ED7E5C0A4384

Function 00FF10F4 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 743a179bd9b187a372a192a5034362e285ed7902a410573e334a86b7529ac79e
Instruction ID: 0834972d08d1bfde726f747ad8513d502cb831fd030f6143e0500b818322ad7d
Opcode Fuzzy Hash: 743a179bd9b187a372a192a5034362e285ed7902a410573e334a86b7529ac79e
Instruction Fuzzy Hash: 848169B3F1162547F3584929CC543627283EBE5321F2F82788A996B7C8ED7E5C0A9784

Function 010DE01C Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2595edb4b64e4980e0ceefc9eb5dd0356dc44df8d823e10573392423db919352
Instruction ID: 7ca1e450c71fe55dbc8b8d418e113b496978f32841153a84ee5a70010af6c9b9
Opcode Fuzzy Hash: 2595edb4b64e4980e0ceefc9eb5dd0356dc44df8d823e10573392423db919352
Instruction Fuzzy Hash: 4281ADB3F116244BF3440968DC983A26252EB99315F2F8178CF486B7C9D97E5D0A93C4

Function 0103008E Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ff70e57510269d4d3aee29d6d619cbf41da6bf7dc6e3179034f1742cf1a2453
Instruction ID: bfd1408d5f423b18e7598c7255c0fe785b59d3241425124e7ed461b2332db050
Opcode Fuzzy Hash: 0ff70e57510269d4d3aee29d6d619cbf41da6bf7dc6e3179034f1742cf1a2453
Instruction Fuzzy Hash: 8D8188B3F5062547F3548929DC983627693EBD4311F2F82788E886BBC9D97E5C0A5384

Function 01071238 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c9bf05b593c51c07d107663619731938ff5af1b8cfa41b69e1953e47691c60f
Instruction ID: 6cafbfe147a31c6eff70fd17e6e9b36f220b11f6f952a42f4193607b692affbc
Opcode Fuzzy Hash: 0c9bf05b593c51c07d107663619731938ff5af1b8cfa41b69e1953e47691c60f
Instruction Fuzzy Hash: 7781AEB3F115254BF3544978CD583A266839BD1325F2F82788E4CABBCADC7E9C0A5384

Function 010DF12D Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2460342eef53fbb9fc110ee0ce6c469f367e4f63e7a8005cf0b086177a43cc1
Instruction ID: 0759f2557090084002b154c3d29a664c0bbd7a6d9d4ae6135fa5a68fbd8a2288
Opcode Fuzzy Hash: a2460342eef53fbb9fc110ee0ce6c469f367e4f63e7a8005cf0b086177a43cc1
Instruction Fuzzy Hash: 798179B3F116254BF3644C29CC583A266839BE5325F2F82B88E9CAB3C5D87E5C4653C4

Function 0102A0C0 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c33cd0880a78497338f79cf2360d84d0a0aaf8b830f529ccf9c27912d2cc1d3
Instruction ID: 53b7971e0c43be0c76d174c7430251fa99de812216a17454e8fbef958e33d9b8
Opcode Fuzzy Hash: 4c33cd0880a78497338f79cf2360d84d0a0aaf8b830f529ccf9c27912d2cc1d3
Instruction Fuzzy Hash: 3A81AEF3F506254BF3444929DC683A1B683EBE1324F2F42388E996B3C5E97E9D065384

Function 0100320F Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 996a097045b064adaeec0f0a3c4dd3479ba106a0b829909b34a146a4a4b478ac
Instruction ID: a5d8c9222066b719b4a60f847b94c2a782c71380424436d4605ad273c6629595
Opcode Fuzzy Hash: 996a097045b064adaeec0f0a3c4dd3479ba106a0b829909b34a146a4a4b478ac
Instruction Fuzzy Hash: A3819DB3F111148BF3584E28CC653A67293EBD5310F2F817C8A899B3C4DA7EAD4A5784

Function 010540CB Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd3212f4cb5b4da8940f1c09a1611a52c4f7c55820dc2a7c64c5a4858049fc15
Instruction ID: 5805e620017acca20542b1b701afde0b3486a10800649306343e3c7f7bd12764
Opcode Fuzzy Hash: bd3212f4cb5b4da8940f1c09a1611a52c4f7c55820dc2a7c64c5a4858049fc15
Instruction Fuzzy Hash: 9281BCB3F115254BF3444D39CC583A23693DBD1311F2F82788A89AB7C5D97EAD0A5384

Function 010B2302 Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a54085eff7770e1492b18df883454d813c76c10987b6de72cebd7d6ac86d0e8
Instruction ID: f827b664e0734b5b84eca8953f3a17c02901de49cb29bccf679826646a455741
Opcode Fuzzy Hash: 3a54085eff7770e1492b18df883454d813c76c10987b6de72cebd7d6ac86d0e8
Instruction Fuzzy Hash: 34816BB3F1112547F3544D2ACD983A17693ABD1310F2F82788E8C6BBC5D97E6D0A5384

Function 00FFC0FB Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e978a98603958446d2c8b3b1e3b7f6aed849300d14d01f57203e1214eb7d613
Instruction ID: abb4edd918e97e4bfd8a7f0ab103120206712b3463f8de48eeaba3ec70d094fe
Opcode Fuzzy Hash: 5e978a98603958446d2c8b3b1e3b7f6aed849300d14d01f57203e1214eb7d613
Instruction Fuzzy Hash: 28817CF7F115254BF3404969DC583626243ABE0325F2F81788F586BBCAD93E5C0A53C4

Function 0105216B Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4daa93b710284151e627fcb87785c084090324bf6f722e0274d3f7c462172529
Instruction ID: 4438b9689054dd7ebc6ead821a1b4feca1137e414dc4710e9d9aa1ddd423fb87
Opcode Fuzzy Hash: 4daa93b710284151e627fcb87785c084090324bf6f722e0274d3f7c462172529
Instruction Fuzzy Hash: C5818BB3F105254BF3544D29DC583A67293EB94320F2F82798E89AB3C5E97EAD095384

Function 0102213D Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc352b3e2e70ac43d9a1725db24a9f28ecda6bf28448981aa9dc9bdefeaa12b4
Instruction ID: bcbc92f57345ca99a1ee898dcf97fa764d55facf1ca041dc67a6e9378b7565bb
Opcode Fuzzy Hash: dc352b3e2e70ac43d9a1725db24a9f28ecda6bf28448981aa9dc9bdefeaa12b4
Instruction Fuzzy Hash: D0819CB3F116254BF3544928CC983A67693DBD4325F2F82788E886BBC9D93E9D054384

Function 00FFE1C5 Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7287e2775dbc507a6859657fa6c1fb92eafad9c484663d3fd114c4b6ea236927
Instruction ID: 298512a4a86e33f66e9538b0c50cd5808f0a2219e1ce82c3ce21e31411bc31df
Opcode Fuzzy Hash: 7287e2775dbc507a6859657fa6c1fb92eafad9c484663d3fd114c4b6ea236927
Instruction Fuzzy Hash: 93817EF3F516244BF3544869DC983A26683DBE0325F2F82788E8CAB7C5D8BE5C495384

Function 0100A1D5 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24718f6d5efd028eacbd69b62d26cd8f230017375835c2ec56b8a223ea57dc9c
Instruction ID: 669d72eeb178df107f3d71855fa88825f499e413e15347c27a1c9424ce71cb1e
Opcode Fuzzy Hash: 24718f6d5efd028eacbd69b62d26cd8f230017375835c2ec56b8a223ea57dc9c
Instruction Fuzzy Hash: E1819EB3F102144BF3484E29CCA83B67683EB95314F2E817C8E899B7D5D97E6C499384

Function 01093162 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4888c05f849d57f32a4560aa224e9187aae583ac74d698d6c998a178235aa504
Instruction ID: 5aff840ffefa78c79ab2b404089a8b312c40bfa891de036adf79795210edbc43
Opcode Fuzzy Hash: 4888c05f849d57f32a4560aa224e9187aae583ac74d698d6c998a178235aa504
Instruction Fuzzy Hash: D6819BB3F116254BF3404929DC98352B2939BE4325F3F42788E5CAB7C6D97E9C068388

Function 01063188 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 270c8527c1c52f98a2c3f2a1d1f0218e3b5dd174a9d9fae9e59a262ece1a42db
Instruction ID: 3e70e518ac4c82385feef18e5e2b08c78b5142fef53df2ab091999dae885df4d
Opcode Fuzzy Hash: 270c8527c1c52f98a2c3f2a1d1f0218e3b5dd174a9d9fae9e59a262ece1a42db
Instruction Fuzzy Hash: 158169B3F116254BF3504929CD983A26683DBE5325F2F82788F5C6B7CAD87E5C464384

Function 00FF634E Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72d0ef1f675cec31b26d9556e414cbac2522895e6ee173c60ec7957c75a9e080
Instruction ID: aac05feacbeb60bf0a32ab8fe232fe40a89b9a8f8d0fcee98ae9a76ed38d4fc6
Opcode Fuzzy Hash: 72d0ef1f675cec31b26d9556e414cbac2522895e6ee173c60ec7957c75a9e080
Instruction Fuzzy Hash: 8481DDF3F116254BF3400969CC983A6B6939BE4321F2F81788E4CAB7C6D97E5C0A5384

Function 0102000A Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ca00ca9dcc99d1e457a96b24877b49710bf65f94150d819ea736a2975b29b28
Instruction ID: e4c617556a50ae31eed768414992f09f3313af605eb2267ef7cc15aae9f549f8
Opcode Fuzzy Hash: 5ca00ca9dcc99d1e457a96b24877b49710bf65f94150d819ea736a2975b29b28
Instruction Fuzzy Hash: 7C7167F7F016214BF3544969DC983622583DBD5325F2F82788E9C6BBCAD8BE5C0A4384

Function 0110F25C Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b067f046372f2a62d5acac4cd0a58b990dbe666243af39b95dc57451121420a0
Instruction ID: 8439e81d15f1aa1675c268e9ae0c7154295fc6f73eeee2ebf47ba0b2bcde30c1
Opcode Fuzzy Hash: b067f046372f2a62d5acac4cd0a58b990dbe666243af39b95dc57451121420a0
Instruction Fuzzy Hash: 35819DB3F1161547F3444C39CD98362A683EBD5325F3F82388B589B7C9D9BE9D0A5284

Function 0111E2CE Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d5f4fde0ca9e12b8a21a3ac9d437bd8cae0f1a28d7a564ccf88a1f6061dc8bc
Instruction ID: 10521497117ce963a05683cb02bf9aca0f02210a0332bc98ddf60892c245ed36
Opcode Fuzzy Hash: 5d5f4fde0ca9e12b8a21a3ac9d437bd8cae0f1a28d7a564ccf88a1f6061dc8bc
Instruction Fuzzy Hash: 46817BB7F106244BF3444979DC583A27682EBE4314F2F81788F48AB7C9E97E5D0A5384

Function 0101E23D Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82cf9a158851c146b3c41c6ad22644e5cf80d4a879735965ebc8031af8ad67e9
Instruction ID: 7fb4d3265e6effcedb630d399efb02e7da2de29b76b80a41654c6eca466f58c9
Opcode Fuzzy Hash: 82cf9a158851c146b3c41c6ad22644e5cf80d4a879735965ebc8031af8ad67e9
Instruction Fuzzy Hash: 7F81DCB3F106254BF3544A69DC983767652EB95320F2F82788F4C6BBC5C97E6C099388

Function 010BD272 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bec6984d2732ce47950fbedd0c9ab04ad80e3d1284d5792930453f10664f3587
Instruction ID: 5a36a9b9cc32cae82136fc28d327d343414d4ac70aba10d56049d9eb57b920a9
Opcode Fuzzy Hash: bec6984d2732ce47950fbedd0c9ab04ad80e3d1284d5792930453f10664f3587
Instruction Fuzzy Hash: 5F718AB3F115244BF3584969CC583627283ABD5315F2F82788E4DAB3C5DD7E5C4A5388

Function 00FF904F Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67b97277d6401c01611322afd53491a9240b065511f3dce11ee43031342ed560
Instruction ID: 6d032e2d5032eb225a7ea84c39aa918629e5e24ab10655fd16c68d07a3c9cb7b
Opcode Fuzzy Hash: 67b97277d6401c01611322afd53491a9240b065511f3dce11ee43031342ed560
Instruction Fuzzy Hash: B771BEB3F106264BF3500D69CC9836276839B95324F3F82788E98AB7C5D9BE5D0A53C4

Function 010F313D Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32d3ad42afa4070bea469def09598a5cfce069ebbe22f5b2ecd218a5d2bd64ab
Instruction ID: 0abd344380bad1c1ee7c8ec30edabc174953a24aafd896d2a95afc42f8a26c40
Opcode Fuzzy Hash: 32d3ad42afa4070bea469def09598a5cfce069ebbe22f5b2ecd218a5d2bd64ab
Instruction Fuzzy Hash: 34719CB3F511254BF3504979CD983A26683EBD5321F2F82788E98ABBC9DC7E5D095380

Function 0105E36A Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c7fe3038a20c8388d5f6d589e92b854cdf7d1a779e47e2057a09384289c55c2
Instruction ID: c592b4b2196674849400d46b7339e5fc5e0f97798df79b8f305b5aa05f00d355
Opcode Fuzzy Hash: 6c7fe3038a20c8388d5f6d589e92b854cdf7d1a779e47e2057a09384289c55c2
Instruction Fuzzy Hash: 25718FB3F111248BF3548E29CC983B27693EB95310F2F41798E886B3C5D97E6D059784

Function 01058350 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 864247b4eb586274a73bdfa11c5609a203d6fa7a546a069d214e0142384258ed
Instruction ID: 6ab1dfa18b393145500e587fd96427c27d4c17532b45261d6570c45f033c41a5
Opcode Fuzzy Hash: 864247b4eb586274a73bdfa11c5609a203d6fa7a546a069d214e0142384258ed
Instruction Fuzzy Hash: 99719CB3F2162547F3944869CC983A26293EBD5321F2F82388E689B7C5DD7E6D095384

Function 010060DD Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bc116ab4d8e36c7765ec382bb4cbec914da3dbce8b32c23fa59bbdc6f992e4e
Instruction ID: 3b561383edffeace08820e5c6d329039e13452b00b8ff973df9971440ba0b5d0
Opcode Fuzzy Hash: 8bc116ab4d8e36c7765ec382bb4cbec914da3dbce8b32c23fa59bbdc6f992e4e
Instruction Fuzzy Hash: 2571B0B3F5162507F3444879DD583A66683D7D5320F2F82388E49A7BCADD7E9C0602C4

Function 010A9052 Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e958996a15172294474bafaab586f73c35dded98d4df8811f75b618f548d6350
Instruction ID: 8fcb86d9ac682d06605ef321ef16f7aeeb71a7022bd1242d56ea7f6a3716c078
Opcode Fuzzy Hash: e958996a15172294474bafaab586f73c35dded98d4df8811f75b618f548d6350
Instruction Fuzzy Hash: 41716AB3F1162647F3544D79DC98362A283ABD5715F2F82388E88AB7C5ED3E9C095384

Function 0100C205 Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d11c5a32afefbab38ec6933bf885804beb2a52ca18b31fbb844a5df58c09a1a2
Instruction ID: 917fa417886db6b562afb1357e31d9419f447a8737a13e1095a3ca4a1c95126c
Opcode Fuzzy Hash: d11c5a32afefbab38ec6933bf885804beb2a52ca18b31fbb844a5df58c09a1a2
Instruction Fuzzy Hash: 8771CFB3F112248BF3444E29CC943B2B392EB91311F2F81798E88AB7C5D97D6C0A5784

Function 01056039 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6e9bf58563558b2fa85a79bf346cbab8d8b3a81706352a56e5584e8ead75faf
Instruction ID: 84225bdb37aa9a6c71d1e178748ed58a9678ce4d9a75e3e9e45294920c171822
Opcode Fuzzy Hash: a6e9bf58563558b2fa85a79bf346cbab8d8b3a81706352a56e5584e8ead75faf
Instruction Fuzzy Hash: 4061F4F3A081105FE304AE29D85573AB7E5EFD4320F1A8A3DDAD9D7384DA3548058796

Function 0107F362 Relevance: .2, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8ef390e296fd4c48e284c39ce3b7bcdb92608b1c371663fcf4f42a079a46580
Instruction ID: 9302173d1ff61db07514743b2ed92c6542a4100c3f2b2b008de908de1ae95490
Opcode Fuzzy Hash: f8ef390e296fd4c48e284c39ce3b7bcdb92608b1c371663fcf4f42a079a46580
Instruction Fuzzy Hash: 8D717EB3F016254BF3544E29CC98366B692EB94310F2F81788E8C6B7C5DA3E6D0557C4

Function 010E229A Relevance: .2, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67d7968ce794fc0e5af092ddbe297cce2c03692e3af0600c2e1f7695bb0cfb0b
Instruction ID: 4360702750932f5c5ecb1b9b1ee5484c14f4b75f61d8bbcbeeb1ed4695b9ee76
Opcode Fuzzy Hash: 67d7968ce794fc0e5af092ddbe297cce2c03692e3af0600c2e1f7695bb0cfb0b
Instruction Fuzzy Hash: E05146F39186189FF7047E29ED457BABBD9DB54360F1B093DDEC483780EA3658048692

Function 01001332 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6e6f8fc0e542ff2a8c1a41ebfde5a631f9d897324308ad5772d0a89b8687682
Instruction ID: e6fedd92b4904094732b30bc6b8f9d06432e67eabf87af87e47bc3e42642c778
Opcode Fuzzy Hash: c6e6f8fc0e542ff2a8c1a41ebfde5a631f9d897324308ad5772d0a89b8687682
Instruction Fuzzy Hash: C971BFB7F116248BF3404E65DCA43727652EB96321F2E8278CE586B3D5DD3E6C099384

Function 0104937B Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37dfe8ce5fb12f162ac067bb586e70e837a924f112b29ee1eba36063569022fa
Instruction ID: 4e255cc50c55dd8cad2e3c0cfa7b25614eac259a254d257ab919cb8b631bd34b
Opcode Fuzzy Hash: 37dfe8ce5fb12f162ac067bb586e70e837a924f112b29ee1eba36063569022fa
Instruction Fuzzy Hash: 39513AB3E082149BF3106A2DEC84766BBD5DFD4720F1B853DDAD887784D97A4C458286

Function 011060A5 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ed89a18ee0358c285b11ae63345e46030163a23fe2c8aea604778a3618e671e
Instruction ID: b3117b872f753186d243d1836b41134f9f4a0e2bf30e1ddf9c58328326c82ffa
Opcode Fuzzy Hash: 8ed89a18ee0358c285b11ae63345e46030163a23fe2c8aea604778a3618e671e
Instruction Fuzzy Hash: BB6168B3F111224BF3644D29CD583626683EBD5315F2F86788E8CABBC4D93E5D0A9384

Function 010423C7 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b93fe2ae8cf134f4d628fbe3d509fd444bb78276ff5e020c27edde66744d012
Instruction ID: c3a167ff87309bc0c6fe126355e33bc989df4d26850320a8df8973f5c8c5ad3c
Opcode Fuzzy Hash: 5b93fe2ae8cf134f4d628fbe3d509fd444bb78276ff5e020c27edde66744d012
Instruction Fuzzy Hash: C961E2B3F112244BF3444978CC983A27692DB95325F2F82798E486B7C9DDBE6D0953C4

Function 01005168 Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2b329f898466a70035e149ebe050d89aa19c73a93a5fb64a2cfdab90a9ebe82
Instruction ID: c60f41095fe71609db06656ed67ffa3dd1579c1a33219de19c3c6d443b3e9c32
Opcode Fuzzy Hash: b2b329f898466a70035e149ebe050d89aa19c73a93a5fb64a2cfdab90a9ebe82
Instruction Fuzzy Hash: 396188B3F116254BF3444979CC983627693ABD5310F2F82788E585BBC9DC3E5D0A9784

Function 011202CA Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 870a380f3a4ee78f0f94ca72a5d0264bf05108abab3ec7ee93e240897f6949f6
Instruction ID: 00a7347a57f8d1e33d3983e2146ecad45230cd837bdf2a8d00f59c479ee3dd80
Opcode Fuzzy Hash: 870a380f3a4ee78f0f94ca72a5d0264bf05108abab3ec7ee93e240897f6949f6
Instruction Fuzzy Hash: 3F618CB3F106254BF3584E28CC583A27293DB95311F2F417C8E49AB3C5E97EAD4A9384

Function 0102B329 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc65c45c6236ef6e6282c86ac2248b18148012514f17e80de6434e52163f8ab7
Instruction ID: 7a400cd092c598d9828ee7ad85ce9001bf93cc46a1296e93615e29e8892f77d9
Opcode Fuzzy Hash: bc65c45c6236ef6e6282c86ac2248b18148012514f17e80de6434e52163f8ab7
Instruction Fuzzy Hash: D8618FB3F215244BF7444D29CCA83623653EB95315F2F8278CE89AB7C5D93EAD099384

Function 01008359 Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d0f2b49718daa1145a10fd18838d75eb0f6196020a99029073f3d867750c29c
Instruction ID: 85278a9244c241989efd887f60c08a27b968da5f98f435bae33dc336f5c92d47
Opcode Fuzzy Hash: 1d0f2b49718daa1145a10fd18838d75eb0f6196020a99029073f3d867750c29c
Instruction Fuzzy Hash: 326187B7F112214BF3944929CD983A67683ABD0311F2F82788E9C6B7C6DD7E5C0A5384

Function 0112A216 Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acff80bd74f5ec4380dfebd75511555bd30f0d7d24fb33b47c220725300d3bc5
Instruction ID: 2938b04c9355158f11916638bddd6e56e25b1354eccd091f7147de8aaed6b4cf
Opcode Fuzzy Hash: acff80bd74f5ec4380dfebd75511555bd30f0d7d24fb33b47c220725300d3bc5
Instruction Fuzzy Hash: 2F618CB3F106218BF7444D79CD583627A93EB95320F2F82788E58AB7C8D93E5D095384

Function 00FEB119 Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad3a35cf6412480e6ebe9ee2116f2a5735508f2faedcaa942ae4d9f8ec5387b0
Instruction ID: f600c2d9f903b613098aa83ff79416b0c9543fd16a971153d93407c696685349
Opcode Fuzzy Hash: ad3a35cf6412480e6ebe9ee2116f2a5735508f2faedcaa942ae4d9f8ec5387b0
Instruction Fuzzy Hash: E161CEB3F102208BF3444E29DD983A27693EB94301F2F41788E48AB7C5DA7FAD095384

Function 01085266 Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7e496a8ca9749a7596c05aeac6c65c41d18651d6c973ed3fdb11ac12bf470eb
Instruction ID: be5b49f99c8dedcdeeb9fdd2639c8a5a7084257817eac7c6e59fd81a44bf8f35
Opcode Fuzzy Hash: b7e496a8ca9749a7596c05aeac6c65c41d18651d6c973ed3fdb11ac12bf470eb
Instruction Fuzzy Hash: 1A61AEB3F1122587F3544D29CCA43627293EBD1320F2F82388A996B7C9DD3E5D0A5384

Function 01058056 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a029d22088324fb8ec5f80b83f71aacd1b606615f7005fed0effea2050f809b
Instruction ID: 64d888df090ec8663437b2f6defac7ab40dea8677dd5f3bc50227ef438810aee
Opcode Fuzzy Hash: 0a029d22088324fb8ec5f80b83f71aacd1b606615f7005fed0effea2050f809b
Instruction Fuzzy Hash: 1D6189B3F1252547F3544929CC583A67283EBD4320F3F82388A5C5B7C5E97E6E0A9784

Function 011272E6 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5f83087184c6eca89bff24fdefea5fbb05b3dc248cc86f9abdd1e05b1447fd5
Instruction ID: 16af49c43c48b2298efe1c8383f33365f3499898ecf1240c47341d8fb45fa317
Opcode Fuzzy Hash: e5f83087184c6eca89bff24fdefea5fbb05b3dc248cc86f9abdd1e05b1447fd5
Instruction Fuzzy Hash: A6518EB3F115204BF3544939CC593A62583EBD5324F2F82788E4CAB7C5D97E9D0A5388

Function 0106C260 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5ccaab43d66f97fc452841d580978a5f6254d13bc24951d69eff06daf349abe
Instruction ID: c81ac1e96fe6e00450c66486199f9e3f59c5f0f628819b687a21df5f12ebfed8
Opcode Fuzzy Hash: e5ccaab43d66f97fc452841d580978a5f6254d13bc24951d69eff06daf349abe
Instruction Fuzzy Hash: A0617CB3F116244BF3444E29CC943627393EB95315F2F81788A886B7C5ED7EAC1A5384

Function 010641A8 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab328065259c137fd842d12a3ce9ec8ac22c45865fbc1dc6d8812d29fec46f50
Instruction ID: d73f1be85ed161b7b71184dfcf765cf7e4165e15c09566a3df190c7250648732
Opcode Fuzzy Hash: ab328065259c137fd842d12a3ce9ec8ac22c45865fbc1dc6d8812d29fec46f50
Instruction Fuzzy Hash: 1A5189B3F112214BF3844D79CCA836666839BD5315F2F82788E5C6B7C8DC7E5C0A5284

Function 0105E066 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0118b1907559233c33ec96f1c7f6e6e029ab6cc6b6bf3aebbac92740d0f2c4e0
Instruction ID: 434af8c544d50d39064c5ba5e28c84673bdd60260761a97141c33055a0a3480e
Opcode Fuzzy Hash: 0118b1907559233c33ec96f1c7f6e6e029ab6cc6b6bf3aebbac92740d0f2c4e0
Instruction Fuzzy Hash: 0051D1B3F116104BF3484D68CD983623693DB95311F2E867C8F49ABBC9C97E6D095788

Function 010922C5 Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f264df033a510bfd893645e32a91eea74204d785d463a2d712253d3d419e270
Instruction ID: 9c6515c2eb2afa2eb78b82fb68972cc0ab44c825abef122c40fbbdadbd97b646
Opcode Fuzzy Hash: 8f264df033a510bfd893645e32a91eea74204d785d463a2d712253d3d419e270
Instruction Fuzzy Hash: 3851BEF3F116214BF3544968DC993A56283EBD5324F2F82788E9CAB7C2D97E9C095384

Function 0101410C Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fb0403936db3ef77d84016e8fd4d3782e6068cf01f249db4960bff0507241b2
Instruction ID: abb005dd54bb00a8724d0bddcbe9fc1f3551839f944b2963ae8d3c6fff1e8f6b
Opcode Fuzzy Hash: 9fb0403936db3ef77d84016e8fd4d3782e6068cf01f249db4960bff0507241b2
Instruction Fuzzy Hash: 28516AB3F105254BF3584969DCA93767282EB94320F2F427D8E8AAB3C4D97E6D0653C4

Function 00FF8278 Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ae601a6f8780ac902669bda16cb498ba9a98eb585f56360318c94f1e504427a
Instruction ID: 63f02a3a400b89c243cf8b0ba3ff42abb3ff52d372a608ccdecb55b4dbc2ec10
Opcode Fuzzy Hash: 9ae601a6f8780ac902669bda16cb498ba9a98eb585f56360318c94f1e504427a
Instruction Fuzzy Hash: D0515873F112254BF3504E69CC683A27692EB84324F3F81788E886B7C5D97E6D0A97C4

Function 0106F319 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 542e4cf1cc45f44eb9119cb53f7ed4b90aaccb7346e063b761d8f3485411d6ce
Instruction ID: fd5356856d3ff75b12cbbbc444b58fb89a4ef4f348e9e0f1e47419b31e65ecd0
Opcode Fuzzy Hash: 542e4cf1cc45f44eb9119cb53f7ed4b90aaccb7346e063b761d8f3485411d6ce
Instruction Fuzzy Hash: 2D516EB3E112258BF3504E69CC98362B693EB94324F3F42788E986B7C5E97E9D0553C4

Function 01116028 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65c53696eb9ecba6aa83dc9b634ebd701ed83c0fa5e48ba16f7bf7567c804f7a
Instruction ID: b16b94d41083932c2ab643decd3895d6ecd1d2fda8503692ec8f2ee0cb559479
Opcode Fuzzy Hash: 65c53696eb9ecba6aa83dc9b634ebd701ed83c0fa5e48ba16f7bf7567c804f7a
Instruction Fuzzy Hash: EF519CB3F106258BF3084E69CCA43B17692EB85714F2F417D8E895B3D0D97E6D099784

Function 0110A19E Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97a07666546348838a0a83c9e0cf3c8edd196899b4b9d7df66ac0b2c7f0f37b7
Instruction ID: 1f437f7e10b5c48dd0d8a7b5dabec3b765057c98cce081cebaae172cdcffaa30
Opcode Fuzzy Hash: 97a07666546348838a0a83c9e0cf3c8edd196899b4b9d7df66ac0b2c7f0f37b7
Instruction Fuzzy Hash: 68515973F111254BF3544E19CC943A2B393EB95321F2E82788D886B7C4DA3EAD0A9784

Function 00FEE249 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f5b0386be608eda20c80eee373a5751fb57f5b674f7d7a7fb8c256f8a51d0be
Instruction ID: a5236e28e6e0e8bc605f2a834fda572a36161b7cf0a2668d9065218a1aadf619
Opcode Fuzzy Hash: 4f5b0386be608eda20c80eee373a5751fb57f5b674f7d7a7fb8c256f8a51d0be
Instruction Fuzzy Hash: 1E514B73F112258BF3444E69CC943A27752EB86314F2E817CCE881B3D4DA3E6D59A784

Function 01000197 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e3336b1a5bb9e622e8154b399a897886a40fc982c115f5f0ba08f549765c737
Instruction ID: b29dc5e5a331a0cdff9ca8498f8558564b2d0cd1e813496979786d0f9f33dc17
Opcode Fuzzy Hash: 2e3336b1a5bb9e622e8154b399a897886a40fc982c115f5f0ba08f549765c737
Instruction Fuzzy Hash: DE519EB3F116254BF3444D38CC983A27392EB95315F2F41788E49AB3C5D97EAD099788

Function 011E2150 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8db1dab838bb1b2fbe4be739babb3db51f18228beeffd25c6b4629690315636d
Instruction ID: bce8a2bea69ce3788de2606f3d5c4f3bbb3b74e6526703537916a0bf023e4ee6
Opcode Fuzzy Hash: 8db1dab838bb1b2fbe4be739babb3db51f18228beeffd25c6b4629690315636d
Instruction Fuzzy Hash: 4A416FB290C6009FE715AE28DC41B6EB7E6EF98310F16893CEAC593350E6395854CB87

Function 0103D1B4 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc3cbcac3a75ebddece5dfd731ef4c1beb21270699fa8d7ae8910548b3a45855
Instruction ID: 7e8531196ad53de73e07a5b47b5975e36cace4974b148d3e83525a2fac2bb761
Opcode Fuzzy Hash: cc3cbcac3a75ebddece5dfd731ef4c1beb21270699fa8d7ae8910548b3a45855
Instruction Fuzzy Hash: 4641AEB3E516354BF39449A8DCA8376A652AB95320F2F82788E9C3B7C5DD7E1C0857C0

Function 0107C275 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4764c92702a31e3a9f0bff5eb73293fe6282d583a09ac209045fb5122775325e
Instruction ID: ee5cb2579f71e50a7fcb9907e18c562ad55669c9369b0f7abb61706217bd39e9
Opcode Fuzzy Hash: 4764c92702a31e3a9f0bff5eb73293fe6282d583a09ac209045fb5122775325e
Instruction Fuzzy Hash: F1419CB3F1052547F3144D28CC643A27292DBC4315F2F82788E896B7C9D93E6C065384

Function 010E4313 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10c2a8404aaa159d8cf1d73b8290e5188b9b0aeed5082919f96d05de50221330
Instruction ID: 6e83195d000f88369da500a1354bb0b39bf2016051ffa5ceeda9aecd82ef550c
Opcode Fuzzy Hash: 10c2a8404aaa159d8cf1d73b8290e5188b9b0aeed5082919f96d05de50221330
Instruction Fuzzy Hash: 6F418DB3F9162547F3544838DD483A2259397E4325F2F82788E5CAB7CAD87E9D0A1384

Function 010E614D Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acb0bfc9614382362aaca949490456d143c03515f97b04e9d1e9aa5d0293a4b2
Instruction ID: 3779caa821b6315fac96d084e14e6c8b073b7f830e672eba9b8ce15c7330de52
Opcode Fuzzy Hash: acb0bfc9614382362aaca949490456d143c03515f97b04e9d1e9aa5d0293a4b2
Instruction Fuzzy Hash: 953192B7F016244BF3888939CC683662183E7D4325F2EC23D8B8997BC9DC3E59055380

Function 0102502E Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b32a5e71386668e6c3ee4d218af9888eb575388026a260df4abfc05cb0a56689
Instruction ID: 867a62956b5642f49605aca7b75c60f1e9e962778d42140c857e296252689432
Opcode Fuzzy Hash: b32a5e71386668e6c3ee4d218af9888eb575388026a260df4abfc05cb0a56689
Instruction Fuzzy Hash: 66316BB3E021254BF3944969DC683A66683EB95320F3F82788E896B3C1DD7E5C0A53C4

Function 010F10C5 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43218d1fc3b0843f4d716baf412430f376c7ea33752a754ca56de47645c53e7f
Instruction ID: 653f3cd8bfa58bb10a22270a4e08323c8e1d860474abe22f04d6aeba1c26c24a
Opcode Fuzzy Hash: 43218d1fc3b0843f4d716baf412430f376c7ea33752a754ca56de47645c53e7f
Instruction Fuzzy Hash: F03147B7E516250BF3844835CE983A6654397D0321F2F82388F6C6BBCAD87D5D0602C8

Function 010AA0E4 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd798f6f9cb3f971ddf50c21307ad360c3b6f58962690126cbea27deb38523e2
Instruction ID: c139949fbc179f72ceb6f456691b56428123599a3d33beae3d69b24e16d799dc
Opcode Fuzzy Hash: bd798f6f9cb3f971ddf50c21307ad360c3b6f58962690126cbea27deb38523e2
Instruction Fuzzy Hash: 5231F5F3F1152147F3504829CD5835265829BA5329F2F82759FACBB7C6E8BE9C4A43C8

Function 010081C1 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 129acfd4214bcc6b73584315b3216c969ee577fbb91a558f4d9cf0c2d809b90d
Instruction ID: 46a620624ac05725fac4268b7f0d3117918f6631cd572782c6f503238e981045
Opcode Fuzzy Hash: 129acfd4214bcc6b73584315b3216c969ee577fbb91a558f4d9cf0c2d809b90d
Instruction Fuzzy Hash: 1B3198B3F116254BF3504929CC943626682ABE1314F2F8179CAC86B3CADDBE5C0653C0

Function 0104F28F Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2540789781cd33c87e7f6883dff43164f390c7f4fbe75c924411d6b6b6fd5734
Instruction ID: d3320b8b1de52ff8a7d776ec49701b4a612b34971ccbb36c419e287d6a2b7834
Opcode Fuzzy Hash: 2540789781cd33c87e7f6883dff43164f390c7f4fbe75c924411d6b6b6fd5734
Instruction Fuzzy Hash: 6B3151E3E51A2107F3884465CDA93B66182DBD4324F2F813D8F5E6BBC6D97D5C0652C8

Function 011232A0 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f261aef8a56ebedebb246662f696d2284efe9d4938c9c79d90447e69495ea2b7
Instruction ID: 48badfcb63d41dd907e705c17f5b4a792f16783ca2d672cbfedd11cfb46c68d4
Opcode Fuzzy Hash: f261aef8a56ebedebb246662f696d2284efe9d4938c9c79d90447e69495ea2b7
Instruction Fuzzy Hash: 6D3159B3E5012147F3644C39CDAA3A26583DB90325F2F83395EA967BCADC7D4C065284

Function 0113A328 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24d36cb9b54b27333c076f0914f5ae3b9307ba48d7e0ee45a5d6cb63c070830b
Instruction ID: c28af7b1c5f57947ff361bd4740cb15005c4d6cd2c87fdf1e259855b61f90097
Opcode Fuzzy Hash: 24d36cb9b54b27333c076f0914f5ae3b9307ba48d7e0ee45a5d6cb63c070830b
Instruction Fuzzy Hash: 5A3123F7F5152107F3A44879CD58366A583ABD0320F2F82388E5DA7BC5D8BE9D0A12C4

Function 0103A23A Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed0d33fcf60254e3a33f6015f1f1ddbfb0ab54896ec9bd3879ce708d8cda87cb
Instruction ID: 334699ead427b367433ffe168a11bd20fbd913be883dba15e9d3cce73058ff19
Opcode Fuzzy Hash: ed0d33fcf60254e3a33f6015f1f1ddbfb0ab54896ec9bd3879ce708d8cda87cb
Instruction Fuzzy Hash: 40313EF7F61A2547F3484829DC953636183D7E4315F2F85398B19EBBCAD87E9C021284

Function 010BF12C Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41c3e410f5d0e2baa7e07f8d2d664fcd0d652659dad7ec4fab6227b34177d2b3
Instruction ID: 0105e6d9365168312661ff2775679b326978a76c0c9e4eb71d27228da75b4da6
Opcode Fuzzy Hash: 41c3e410f5d0e2baa7e07f8d2d664fcd0d652659dad7ec4fab6227b34177d2b3
Instruction Fuzzy Hash: F4211DB3F516214BF3584868DC94362A1839BD4324F3F82388F6DAB3C6D9BE8C0652C4

Function 0105200D Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8823731fb24c0386b108a88d9aa8aa36913cf8290af699b4309d2637abdf53a1
Instruction ID: f1c5581b07c3563e2e64c1782e3e0afae700cfef596ebcb57fd3d0b94c38d7bc
Opcode Fuzzy Hash: 8823731fb24c0386b108a88d9aa8aa36913cf8290af699b4309d2637abdf53a1
Instruction Fuzzy Hash: 2521A9B3E506354BF3544878CD983766A82EB84324F2F82788E496BBC5D8BE1D0952C0

Function 0110D3CD Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54ced41781b035ab26a7789da4afab22a5ef2bc96f2f0cd7cdf7c72f321afcf4
Instruction ID: 95792e8b574bbebbf0d101e9cbfb487087b1275f41b13ccee5cb98a12a84e59c
Opcode Fuzzy Hash: 54ced41781b035ab26a7789da4afab22a5ef2bc96f2f0cd7cdf7c72f321afcf4
Instruction Fuzzy Hash: 42215BB3F5152447F3544879DD693626583A7E5324F3F83388AA8AB7C6D87D8C0B4384

Function 011012E6 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3dde1ca0f8683b519e188c6882ac502b2b60137ccbbb94284cf16c5a594039d0
Instruction ID: f88260c7e623619aecdb744df793f146d52b39489d4e304d3fa5de304ce67116
Opcode Fuzzy Hash: 3dde1ca0f8683b519e188c6882ac502b2b60137ccbbb94284cf16c5a594039d0
Instruction Fuzzy Hash: 802179B7F1292247F3984869DC4936662839BD8311F2F82798E4CA7BC4DD7D5C0A13C0

Function 011300FA Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ee024783abb1a690be8210b22ab4a1b2905194fa4e98686acf456a0daa8f079
Instruction ID: f409f3306952ae3004d7b623a1acc99e0fb948b5776e388defc39120198e9cb4
Opcode Fuzzy Hash: 5ee024783abb1a690be8210b22ab4a1b2905194fa4e98686acf456a0daa8f079
Instruction Fuzzy Hash: 53216FB3F1252107F3944829DD583725443EBD1321F2FC6398A995BBC9DCBE5C0A1384

Function 010882F4 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cffa275ee5370370384c8cbcc331b270ef212d2229489e5d167bcaf493f1ecac
Instruction ID: c995472b696dcb9bebe5da60a9460c33647cca0397ac5f4d275aee89a89c096d
Opcode Fuzzy Hash: cffa275ee5370370384c8cbcc331b270ef212d2229489e5d167bcaf493f1ecac
Instruction Fuzzy Hash: E62192B3F026214BF3584879CC553A66583CBD5324F2F82798F58A77D5DCBD5C064284

Function 010863F1 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a929f970d537d5d329d6e99f06978c3931902802e91f372ee82cc208b32f8209
Instruction ID: 0701e3681b879779a46b15949d93403b986d6580a22d54bf023701dbea7ba530
Opcode Fuzzy Hash: a929f970d537d5d329d6e99f06978c3931902802e91f372ee82cc208b32f8209
Instruction Fuzzy Hash: 072190B3F6053507F3904879CD893A6A48397D4324F1F82758E5CA7BC5DC7D9C0A2284

Function 00FDE0D5 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 325a2793c85cc4fdff7f17731e8dbba332664d3181f6ab552afcf76064fc6eeb
Instruction ID: cbeddbcf99c0e95f278539238a62cf081008b954f44922983df8374c88efea19
Opcode Fuzzy Hash: 325a2793c85cc4fdff7f17731e8dbba332664d3181f6ab552afcf76064fc6eeb
Instruction Fuzzy Hash: 092133B290830D9BDB019F6585802EE3BA7EF57331F2C462BD8425B782C2B20D55BA19

Function 01042167 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af5f69a8cedfc8ea6e5db9317ea6a2280bb751e9b586b314b8932f23220c6850
Instruction ID: eb405b6a57fb2ecfe0f3847aed60f899df99665336d8ff0f8b3c4e42c4286e1e
Opcode Fuzzy Hash: af5f69a8cedfc8ea6e5db9317ea6a2280bb751e9b586b314b8932f23220c6850
Instruction Fuzzy Hash: 812160F7F5162147F3848875CC953A36583A7D0725F2F82388E999B7C5DC7D890A4384

Function 01083185 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 827deb27d01a8439d7afeed745f2d72446eeb273c0084c9a9ef87aa39b37b2c2
Instruction ID: fbb0b94b6c836356322041f5a739df5338131a1e9e315ff9e5c61f05198161fc
Opcode Fuzzy Hash: 827deb27d01a8439d7afeed745f2d72446eeb273c0084c9a9ef87aa39b37b2c2
Instruction Fuzzy Hash: 01213BE7F116304BF7604878DD983526543ABA5314F2F82748F982BBC6D97E5D0953C0

Function 010090CB Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 396c1295a8dbdee2efc11d7b68fe9a2cdd88e45419a5d04477d09ce8f6f50bf8
Instruction ID: 7a5a018bc1219acf579c62b11fd0c7a0c085e56e83101b5c3754d0cc6c74368c
Opcode Fuzzy Hash: 396c1295a8dbdee2efc11d7b68fe9a2cdd88e45419a5d04477d09ce8f6f50bf8
Instruction Fuzzy Hash: B82136B7F115214BF3588879CD6836725839BD5324F2F82788B69ABBC9EC7D4D0A42C4

Function 010A521B Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fd90c2730f67c4e39332395340773a1e0c5b4b01ae60d565f7edf0681c1f2d9
Instruction ID: 04c563ed0c64f7097a260a33cbae2e5d0bd4ff40ae083d485fbdea1c473f0be3
Opcode Fuzzy Hash: 6fd90c2730f67c4e39332395340773a1e0c5b4b01ae60d565f7edf0681c1f2d9
Instruction Fuzzy Hash: 2621D0F7E1152047F3448826DC54362264397E5329F2F82349B2C6BBCAED7E990B4288

Function 010F751F Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 464ad97a6ebb7cc5b5d95af166d46a140644a4de7305f0ef5e176f0b8faaf9e9
Instruction ID: 11d961506e3193bb6a2209719d45b1ef0c6519d6b4e59aa6530a57eaee3b6e07
Opcode Fuzzy Hash: 464ad97a6ebb7cc5b5d95af166d46a140644a4de7305f0ef5e176f0b8faaf9e9
Instruction Fuzzy Hash: 25215BB3F626214BF3404879CD493A225839BD5324F2F82798F58AB7C8D87E5D0A4384

Function 011250CC Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca2a64fccf0276084d9c6825e748ad0e4efb95a8076e63fb305c44131ca27e6a
Instruction ID: bcef498792677262eba2c5c8850b2cf1166bedfd7d674ed262470eb6f454edd4
Opcode Fuzzy Hash: ca2a64fccf0276084d9c6825e748ad0e4efb95a8076e63fb305c44131ca27e6a
Instruction Fuzzy Hash: AA2136B3F102160BF3584879CDA832666839BD5314F2F82398E996B7C5DC7E580A5384

Function 0103D2BC Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4c49bf53559fd326dd39686821af801b12a857d43a0050d3b51f3bf27eeff72
Instruction ID: 2409715e6916d40898ea68654876bb32c95b490de28ee26006376b2865d7a2db
Opcode Fuzzy Hash: f4c49bf53559fd326dd39686821af801b12a857d43a0050d3b51f3bf27eeff72
Instruction Fuzzy Hash: 04219DB3E115214BF3904864DC94326A643A7D4324F3F82388E986B7C2DD7D5D0917C0

Function 0104326D Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2313160890.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.2313120502.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313133260.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313146419.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000126E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313160890.000000000127E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313394231.000000000127F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313515848.0000000001422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2313605477.0000000001424000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5aab01eb5c472eea1754b5f526231ee240c8361f7b7f93ec5013434172281898
Instruction ID: fc62c608c6a9086f1af5b8905403ea76a966a712e030ef6b7103b31ace240f58
Opcode Fuzzy Hash: 5aab01eb5c472eea1754b5f526231ee240c8361f7b7f93ec5013434172281898
Instruction Fuzzy Hash: E8214FF3E60A2507F39848A8DD993A25542A7A4318F2F82798F8C6B7C5DCBE1C4953C4

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Analysis Process: file.exePID: 5164, Parent PID: 4004

General

Chronological Activities

Disassembly

Analysis Process: file.exePID: 5164, Parent PID: 4004COMMON

Execution Graph

Graph

Windows Analysis Report
file.exe

Function 011C31DA Relevance: 3.1, APIs: 2, Instructions: 107
memoryCOMMON

Function 011B7EC1 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 83
libraryCOMMON

Function 011B83C7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47
COMMON

Function 011BAD21 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMON

Function 011B6DA1 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 90
COMMON

Function 011B84B0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 32
COMMON

Function 011BAF3D Relevance: 3.1, APIs: 2, Instructions: 57
fileCOMMON

Function 011BA8A9 Relevance: 3.0, APIs: 2, Instructions: 41
COMMON

Function 011C3C06 Relevance: 1.6, APIs: 1, Instructions: 112
COMMON

Function 011B8F28 Relevance: 1.6, APIs: 1, Instructions: 103
fileCOMMON

Function 011B8744 Relevance: 1.6, APIs: 1, Instructions: 92
fileCOMMON

Function 011C3953 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Function 05640D41 Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Function 05640D48 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Function 05641509 Relevance: 1.6, APIs: 1, Instructions: 54
serviceCOMMON