Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1538174
MD5:	bb625c966762131e9418f761c448fdd3
SHA1:	95e0213ce710abaceb2c0aecfb217aa7b0ac2bcc
SHA256:	99a54271b35fd2c3db30fa506be8c72011031d445dd2f28aeedddceebdde5c64
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

PE file contains section with special chars

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Detected potential crypto function

Entry point lies outside standard sections

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 3632 cmdline: "C:\Users\user\Desktop\file.exe" MD5: BB625C966762131E9418F761C448FDD3)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["dissapoiznw.store", "eaglepawnoy.store", "studennotediw.store", "spirittunek.store", "mobbipenju.store", "clearancek.site", "bathdoomgaz.store", "licendfilteo.site"], "Build id": "4SD0y4--legendaryy"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-20T18:13:04.090889+0200	2056477	1	Domain Observed Used for C2 Detected	192.168.2.4	56895	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-20T18:13:04.022551+0200	2056471	1	Domain Observed Used for C2 Detected	192.168.2.4	59249	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-20T18:13:04.060823+0200	2056481	1	Domain Observed Used for C2 Detected	192.168.2.4	58198	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-20T18:13:04.049074+0200	2056483	1	Domain Observed Used for C2 Detected	192.168.2.4	50148	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-20T18:13:04.117140+0200	2056473	1	Domain Observed Used for C2 Detected	192.168.2.4	50736	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-20T18:13:04.032785+0200	2056485	1	Domain Observed Used for C2 Detected	192.168.2.4	60218	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-20T18:13:04.102298+0200	2056475	1	Domain Observed Used for C2 Detected	192.168.2.4	61510	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-20T18:13:04.079249+0200	2056479	1	Domain Observed Used for C2 Detected	192.168.2.4	53659	1.1.1.1	53	UDP

ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-20T18:13:07.017617+0200	2858666	1	Domain Observed Used for C2 Detected	192.168.2.4	49730	104.102.49.254	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://steamcommunity.com:443/profiles/76561199724331900

URL Reputation: Label: malware

Found malware configuration

Source: file.exe.3632.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["dissapoiznw.store", "eaglepawnoy.store", "studennotediw.store", "spirittunek.store", "mobbipenju.store", "clearancek.site", "bathdoomgaz.store", "licendfilteo.site"], "Build id": "4SD0y4--legendaryy"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp	String decryptor: clearancek.site
Source: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp	String decryptor: licendfilteo.site
Source: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp	String decryptor: spirittunek.store
Source: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp	String decryptor: bathdoomgaz.store
Source: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp	String decryptor: studennotediw.store
Source: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp	String decryptor: dissapoiznw.store
Source: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp	String decryptor: eaglepawnoy.store
Source: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp	String decryptor: mobbipenju.store
Source: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp	String decryptor: clearancek.site
Source: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp	String decryptor: 4SD0y4--legendaryy

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:49730 version: TLS 1.2

Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00B850FA
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00B4D110
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00B4D110
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	0_2_00B863B8
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	0_2_00B899D0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 27BAF212h	0_2_00B8695B
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	0_2_00B4FCA0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	0_2_00B50EEC
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp ecx	0_2_00B86094
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then dec ebx	0_2_00B7F030
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+20h]	0_2_00B56F91
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ecx, dword ptr [edx]	0_2_00B41000
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	0_2_00B84040
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	0_2_00B6D1E1
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	0_2_00B542FC
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_00B62260
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [esi], ax	0_2_00B62260
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_00B723E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_00B723E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_00B723E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_00B723E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_00B723E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+14h]	0_2_00B723E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ebp, eax	0_2_00B4A300
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	0_2_00B864B8
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov dword ptr [esp], 00000000h	0_2_00B5B410
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	0_2_00B6E40C
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	0_2_00B6C470
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_00B5D457
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx eax, word ptr [esi+ecx]	0_2_00B81440
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	0_2_00B56536
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 7789B0CBh	0_2_00B87520
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_00B69510
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	0_2_00B6E66A
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	0_2_00B7B650
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	0_2_00B6D7AF
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	0_2_00B867EF
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ecx, word ptr [edi+eax]	0_2_00B87710
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00B85700
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_00B628E9
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	0_2_00B449A0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 62429966h	0_2_00B83920
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	0_2_00B5D961
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	0_2_00B51ACD
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	0_2_00B51A3C
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ebx]	0_2_00B45A50
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	0_2_00B84A40
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	0_2_00B70B80
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	0_2_00B53BE2
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	0_2_00B51BEE
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	0_2_00B89B60
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+000006B8h]	0_2_00B5DB6F
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F8FD61B8h	0_2_00B5DB6F
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	0_2_00B6AC91
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [edx], ax	0_2_00B6AC91
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00B89CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebp+edx*8+00h], 9ECF05EBh	0_2_00B89CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], C85F7986h	0_2_00B6CCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00B6CCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C85F7986h	0_2_00B6CCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], A70A987Fh	0_2_00B7FC20
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	0_2_00B67C00
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp word ptr [eax+esi+02h], 0000h	0_2_00B6EC48
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00B88D8A
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	0_2_00B6DD29
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov dword ptr [esp+1Ch], 5E46585Eh	0_2_00B6FD10
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ecx, word ptr [ebp+00h]	0_2_00B4BEB0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp byte ptr [ebx], 00000000h	0_2_00B56EBF
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edi, byte ptr [ecx+esi]	0_2_00B46EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	0_2_00B51E93
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov edi, ecx	0_2_00B54E2A
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00B65E70
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_00B67E60
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ebx, word ptr [ecx]	0_2_00B6AE57
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+20h]	0_2_00B56F91
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp ecx	0_2_00B48FD0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [edx], 0000h	0_2_00B5FFDF
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp ecx	0_2_00B85FD6
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], F3285E74h	0_2_00B87FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00B87FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00B7FF70
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	0_2_00B69F62

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2056477 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store) : 192.168.2.4:56895 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056475 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store) : 192.168.2.4:61510 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056481 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store) : 192.168.2.4:58198 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056485 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store) : 192.168.2.4:60218 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056483 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store) : 192.168.2.4:50148 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056471 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site) : 192.168.2.4:59249 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056473 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site) : 192.168.2.4:50736 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056479 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store) : 192.168.2.4:53659 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.4:49730 -> 104.102.49.254:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: dissapoiznw.store
Source: Malware configuration extractor	URLs: eaglepawnoy.store
Source: Malware configuration extractor	URLs: studennotediw.store
Source: Malware configuration extractor	URLs: spirittunek.store
Source: Malware configuration extractor	URLs: mobbipenju.store
Source: Malware configuration extractor	URLs: clearancek.site
Source: Malware configuration extractor	URLs: bathdoomgaz.store
Source: Malware configuration extractor	URLs: licendfilteo.site

Source: Joe Sandbox View

IP Address: 104.102.49.254 104.102.49.254

Source: Joe Sandbox View

ASN Name: AKAMAI-ASUS AKAMAI-ASUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic

HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

Source: file.exe	String found in binary or memory: https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.steamstatic.com/ https://store.steampowered.com/ https equals www.youtube.com (Youtube)
Source: file.exe	String found in binary or memory: 1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https:/ equals www.youtube.com (Youtube)
Source: file.exe, 00000000.00000002.1784835994.0000000000731000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: file.exe, 00000000.00000003.1766910824.0000000000731000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: file.exe, 00000000.00000003.1766910824.0000000000731000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: sContent-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C0e3d185a3e106e73b244decdec33a0ea; Path=/; Secure; HttpOnly; SameSite=Nonesessionid=033b555b211399fccfe192b4; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type25258Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveSun, 20 Oct 2024 16:13:06 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-Control equals www.youtube.com (Youtube)
Source: file.exe	String found in binary or memory: steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'n equals www.youtube.com (Youtube)
Source: file.exe	String found in binary or memory: t.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; Expi equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: clearancek.site
Source: global traffic	DNS traffic detected: DNS query: mobbipenju.store
Source: global traffic	DNS traffic detected: DNS query: eaglepawnoy.store
Source: global traffic	DNS traffic detected: DNS query: dissapoiznw.store
Source: global traffic	DNS traffic detected: DNS query: studennotediw.store
Source: global traffic	DNS traffic detected: DNS query: bathdoomgaz.store
Source: global traffic	DNS traffic detected: DNS query: spirittunek.store
Source: global traffic	DNS traffic detected: DNS query: licendfilteo.site
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com

Source: file.exe	String found in binary or memory: http://127.0.0
Source: file.exe, 00000000.00000003.1766910824.0000000000731000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1784835994.0000000000731000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: file.exe, 00000000.00000003.1766617252.0000000000748000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766617252.0000000000742000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1784649036.00000000006C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: file.exe, 00000000.00000002.1784835994.0000000000731000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: file.exe, 00000000.00000003.1766910824.0000000000731000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1784835994.0000000000731000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: file.exe	String found in binary or memory: https://cdn.fastly
Source: file.exe, 00000000.00000003.1766910824.0000000000731000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1784835994.0000000000731000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/
Source: file.exe, 00000000.00000002.1784835994.0000000000731000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: file.exe, 00000000.00000002.1784736653.00000000006CF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766910824.00000000006CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clearancek.site:443/apii
Source: file.exe, 00000000.00000002.1784835994.0000000000731000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/
Source: file.exe, 00000000.00000003.1766617252.0000000000748000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766617252.0000000000742000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/css/globalv2.css?v=dQy8Omh4p9PH&l=english
Source: file.exe, 00000000.00000003.1766617252.0000000000748000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766617252.0000000000742000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/css/skin_1/fatalerror.css?v=wctRWaBvNt2z&l=english
Source: file.exe, 00000000.00000003.1766617252.0000000000748000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766617252.0000000000742000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/css/skin_1/header.css?v=pTvrRy1pm52p&l=english
Source: file.exe, 00000000.00000003.1766617252.0000000000748000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766617252.0000000000742000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/javascript/global.js?v=7qlUmHSJhPRN&l=english
Source: file.exe, 00000000.00000003.1766617252.0000000000748000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766617252.0000000000742000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC
Source: file.exe, 00000000.00000003.1766617252.0000000000748000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766617252.0000000000742000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw
Source: file.exe, 00000000.00000003.1766617252.0000000000748000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766617252.0000000000742000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL&l=
Source: file.exe, 00000000.00000003.1766617252.0000000000748000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766617252.0000000000742000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/shared/css/buttons.css?v=-WV9f1LdxEjq&l=english
Source: file.exe, 00000000.00000003.1766617252.0000000000748000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766617252.0000000000742000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/shared/css/motiva_sans.css?v=v7XTmVzbLV33&l=english
Source: file.exe, 00000000.00000003.1766617252.0000000000748000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766617252.0000000000742000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/shared/css/shared_global.css?v=uF6G1wyNU-4c&l=english
Source: file.exe, 00000000.00000003.1766617252.0000000000748000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766617252.0000000000742000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/shared/css/shared_responsive.css?v=kR9MtmbWSZEp&l=engli
Source: file.exe, 00000000.00000003.1766617252.0000000000748000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766617252.0000000000742000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766910824.00000000006C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: file.exe, 00000000.00000003.1766617252.0000000000748000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766617252.0000000000742000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766910824.00000000006C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: file.exe, 00000000.00000003.1766617252.0000000000748000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766617252.0000000000742000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766910824.00000000006C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: file.exe, 00000000.00000003.1766617252.0000000000748000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766617252.0000000000742000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1784649036.00000000006C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: file.exe, 00000000.00000003.1766617252.0000000000748000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766617252.0000000000742000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1&l=engl
Source: file.exe, 00000000.00000003.1766617252.0000000000748000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766617252.0000000000742000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/shared/javascript/shared_global.js?v=7glT1n_nkVCs&l=eng
Source: file.exe, 00000000.00000003.1766617252.0000000000748000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766617252.0000000000742000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSvIAKtunf
Source: file.exe, 00000000.00000003.1766617252.0000000000748000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766617252.0000000000742000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0
Source: file.exe, 00000000.00000002.1784736653.00000000006CF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766910824.00000000006CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dissapoiznw.store:443/apibcryptPrimitives.dllv
Source: file.exe, 00000000.00000002.1784736653.00000000006CF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766910824.00000000006CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://eaglepawnoy.store:443/api
Source: file.exe, 00000000.00000002.1784835994.0000000000731000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: file.exe, 00000000.00000003.1766617252.0000000000748000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766617252.0000000000742000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1784649036.00000000006C5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766910824.00000000006C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: file.exe, 00000000.00000002.1784835994.0000000000731000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: file.exe, 00000000.00000003.1766910824.0000000000731000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1784835994.0000000000731000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: file.exe, 00000000.00000003.1766910824.0000000000731000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1784835994.0000000000731000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: file.exe, 00000000.00000002.1784736653.00000000006CF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766910824.00000000006CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mobbipenju.store:443/api
Source: file.exe, 00000000.00000003.1766910824.0000000000731000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1784835994.0000000000731000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: file.exe	String found in binary or memory: https://recaptcha.ne
Source: file.exe, 00000000.00000003.1766910824.0000000000731000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1784835994.0000000000731000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: file.exe, 00000000.00000003.1766910824.0000000000731000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1784835994.0000000000731000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: file.exe, 00000000.00000003.1766910824.0000000000731000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1784835994.0000000000731000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: file.exe, 00000000.00000003.1766910824.0000000000731000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1784835994.0000000000731000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: file.exe, 00000000.00000003.1766910824.0000000000731000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1784835994.0000000000731000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: file.exe, 00000000.00000003.1766910824.0000000000731000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1784835994.0000000000731000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: file.exe, 00000000.00000003.1766910824.0000000000731000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1784835994.0000000000731000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: file.exe, 00000000.00000003.1766910824.0000000000731000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1784835994.0000000000731000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: file.exe, 00000000.00000003.1766617252.0000000000742000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.c
Source: file.exe, 00000000.00000003.1766910824.00000000006C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: file.exe, 00000000.00000003.1766617252.0000000000748000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766617252.0000000000742000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1784649036.00000000006C5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766910824.00000000006C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: file.exe, 00000000.00000002.1784736653.00000000006D8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766910824.00000000006D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/UW
Source: file.exe, 00000000.00000003.1766617252.0000000000748000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766617252.0000000000742000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1784649036.00000000006C5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766910824.00000000006C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: file.exe, 00000000.00000003.1766617252.0000000000742000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766910824.00000000006C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: file.exe, 00000000.00000003.1766617252.0000000000748000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766617252.0000000000742000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1784649036.00000000006C5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766910824.00000000006C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: file.exe, 00000000.00000003.1766617252.0000000000748000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766617252.0000000000742000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766910824.00000000006C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: file.exe, 00000000.00000002.1784736653.00000000006D8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1784798926.00000000006E6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766910824.00000000006D8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766910824.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1767142968.00000000006E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: file.exe, 00000000.00000003.1766617252.0000000000748000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766617252.0000000000742000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1784649036.00000000006C5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766910824.00000000006C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: file.exe, 00000000.00000002.1784736653.00000000006CF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766910824.00000000006CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com:443/profiles/76561199724331900
Source: file.exe, 00000000.00000003.1766910824.00000000006C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: file.exe, 00000000.00000003.1766910824.0000000000731000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1784835994.0000000000731000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: file.exe, 00000000.00000003.1766910824.0000000000731000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C0e3d185a3e106e7
Source: file.exe, 00000000.00000003.1766910824.00000000006C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: file.exe, 00000000.00000003.1766617252.0000000000748000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766617252.0000000000742000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766910824.00000000006C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: file.exe, 00000000.00000003.1766617252.0000000000748000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766617252.0000000000742000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1784649036.00000000006C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: file.exe, 00000000.00000003.1766617252.0000000000748000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766617252.0000000000742000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766910824.00000000006C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: file.exe, 00000000.00000003.1766617252.0000000000748000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766617252.0000000000742000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766910824.00000000006C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: file.exe, 00000000.00000003.1766617252.0000000000748000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766617252.0000000000742000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1784649036.00000000006C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: file.exe, 00000000.00000003.1766617252.0000000000748000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766617252.0000000000742000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766910824.00000000006C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: file.exe, 00000000.00000003.1766617252.0000000000748000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766617252.0000000000742000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1784649036.00000000006C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: file.exe, 00000000.00000003.1766617252.0000000000748000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766617252.0000000000742000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1784649036.00000000006C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: file.exe, 00000000.00000003.1766910824.0000000000731000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1784835994.0000000000731000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: file.exe, 00000000.00000002.1784835994.0000000000731000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: file.exe, 00000000.00000003.1766910824.0000000000731000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1784835994.0000000000731000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: file.exe, 00000000.00000003.1766910824.0000000000731000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1784835994.0000000000731000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: file.exe, 00000000.00000003.1766910824.0000000000731000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1784835994.0000000000731000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: file.exe, 00000000.00000003.1766910824.0000000000731000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1784835994.0000000000731000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443

Source: unknown

HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:49730 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata

Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00735FD0	0_3_00735FD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00735FD0	0_3_00735FD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00735FD0	0_3_00735FD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00736FC0	0_3_00736FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00736FC0	0_3_00736FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00736FC0	0_3_00736FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00735FD0	0_3_00735FD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00735FD0	0_3_00735FD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00735FD0	0_3_00735FD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00736FC0	0_3_00736FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00736FC0	0_3_00736FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00736FC0	0_3_00736FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00735FD0	0_3_00735FD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00735FD0	0_3_00735FD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00735FD0	0_3_00735FD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00736FC0	0_3_00736FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00736FC0	0_3_00736FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00736FC0	0_3_00736FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B50228	0_2_00B50228
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B8A0D0	0_2_00B8A0D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B52030	0_2_00B52030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B41000	0_2_00B41000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B84040	0_2_00B84040
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B4E1A0	0_2_00B4E1A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B471F0	0_2_00B471F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D0118F	0_2_00D0118F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CFC168	0_2_00CFC168
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B45160	0_2_00B45160
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D0B2FD	0_2_00D0B2FD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B412F7	0_2_00B412F7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B782D0	0_2_00B782D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B712D0	0_2_00B712D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D06232	0_2_00D06232
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B4B3A0	0_2_00B4B3A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B413A3	0_2_00B413A3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B723E0	0_2_00B723E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B4A300	0_2_00B4A300
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C414CA	0_2_00C414CA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B5049B	0_2_00B5049B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B54487	0_2_00B54487
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B764F0	0_2_00B764F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B6C470	0_2_00B6C470
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B435B0	0_2_00B435B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B5C5F0	0_2_00B5C5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C90555	0_2_00C90555
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C13575	0_2_00C13575
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B886F0	0_2_00B886F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B7F620	0_2_00B7F620
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B88652	0_2_00B88652
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B4164F	0_2_00B4164F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CFF734	0_2_00CFF734
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CA78C5	0_2_00CA78C5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B7E8A0	0_2_00B7E8A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B7B8C0	0_2_00B7B8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D09810	0_2_00D09810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B71860	0_2_00B71860
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B889A0	0_2_00B889A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B6098B	0_2_00B6098B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C299FD	0_2_00C299FD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B87AB0	0_2_00B87AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B88A80	0_2_00B88A80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B84A40	0_2_00B84A40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D02BC7	0_2_00D02BC7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B47BF0	0_2_00B47BF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B5DB6F	0_2_00B5DB6F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B86CBF	0_2_00B86CBF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B6CCD0	0_2_00B6CCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CFDC44	0_2_00CFDC44
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B88C02	0_2_00B88C02
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D07C1B	0_2_00D07C1B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D0CDF2	0_2_00D0CDF2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B6DD29	0_2_00B6DD29
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B6FD10	0_2_00B6FD10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B68D62	0_2_00B68D62
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B4BEB0	0_2_00B4BEB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B56EBF	0_2_00B56EBF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CC7EDA	0_2_00CC7EDA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B54E2A	0_2_00B54E2A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B88E70	0_2_00B88E70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B6AE57	0_2_00B6AE57
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B48FD0	0_2_00B48FD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B87FC0	0_2_00B87FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B4AF10	0_2_00B4AF10

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00B4CAA0 appears 48 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00B5D300 appears 152 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: ZLIB complexity 0.9993618502475248

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@9/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B78220 CoCreateInstance,

0_2_00B78220

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: file.exe	String found in binary or memory: RtlAllocateHeap3Cannot find '%s'. Please, re-install this applicationThunRTMain__vbaVarTstNeR

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior

Source: file.exe

Static file information: File size 2920448 > 1048576

Source: file.exe

Static PE information: Raw size of hgfldvor is bigger than: 0x100000 < 0x29fa00

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.b40000.0.unpack :EW;.rsrc :W;.idata :W;hgfldvor:EW;xsdmkczw:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W;hgfldvor:EW;xsdmkczw:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x2ceb25 should be: 0x2d8add

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name: hgfldvor
Source: file.exe	Static PE information: section name: xsdmkczw
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0073340F push esi; retf	0_3_00733412
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0073340F push esi; retf	0_3_00733412
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0073340F push esi; retf	0_3_00733412
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_007322B2 push ss; ret	0_3_007322BB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_007322B2 push ss; ret	0_3_007322BB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_007322B2 push ss; ret	0_3_007322BB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_007350AC push esi; retf	0_3_007350AF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_007350AC push esi; retf	0_3_007350AF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_007350AC push esi; retf	0_3_007350AF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0073340F push esi; retf	0_3_00733412
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0073340F push esi; retf	0_3_00733412
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0073340F push esi; retf	0_3_00733412
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_007322B2 push ss; ret	0_3_007322BB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_007322B2 push ss; ret	0_3_007322BB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_007322B2 push ss; ret	0_3_007322BB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_007350AC push esi; retf	0_3_007350AF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_007350AC push esi; retf	0_3_007350AF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_007350AC push esi; retf	0_3_007350AF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0073340F push esi; retf	0_3_00733412
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0073340F push esi; retf	0_3_00733412
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0073340F push esi; retf	0_3_00733412
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_007322B2 push ss; ret	0_3_007322BB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_007322B2 push ss; ret	0_3_007322BB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_007322B2 push ss; ret	0_3_007322BB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_007350AC push esi; retf	0_3_007350AF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_007350AC push esi; retf	0_3_007350AF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_007350AC push esi; retf	0_3_007350AF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D130CE push ecx; mov dword ptr [esp], edx	0_2_00D130D8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D130CE push esi; mov dword ptr [esp], 3FDE63F8h	0_2_00D13110
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D130CE push 083ADEBDh; mov dword ptr [esp], esp	0_2_00D13147
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D130CE push 5EF1D611h; mov dword ptr [esp], edx	0_2_00D1316B

Source: file.exe

Static PE information: section name: entropy: 7.975536297032172

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA4496 second address: BA3D84 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F8710F1B5C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b mov dword ptr [esp], eax 0x0000000e xor dword ptr [ebp+122D2AD7h], edx 0x00000014 push dword ptr [ebp+122D1395h] 0x0000001a cmc 0x0000001b call dword ptr [ebp+122D28A3h] 0x00000021 pushad 0x00000022 mov dword ptr [ebp+122D1D01h], ebx 0x00000028 xor eax, eax 0x0000002a jmp 00007F8710F1B5CAh 0x0000002f mov edx, dword ptr [esp+28h] 0x00000033 add dword ptr [ebp+122D1D01h], esi 0x00000039 mov dword ptr [ebp+122D3AD1h], eax 0x0000003f jmp 00007F8710F1B5D6h 0x00000044 mov esi, 0000003Ch 0x00000049 pushad 0x0000004a jns 00007F8710F1B5C9h 0x00000050 call 00007F8710F1B5D1h 0x00000055 mov dword ptr [ebp+122D1D01h], eax 0x0000005b pop esi 0x0000005c popad 0x0000005d add esi, dword ptr [esp+24h] 0x00000061 jmp 00007F8710F1B5D8h 0x00000066 lodsw 0x00000068 jg 00007F8710F1B5CCh 0x0000006e add eax, dword ptr [esp+24h] 0x00000072 pushad 0x00000073 sub dword ptr [ebp+122D1D01h], ecx 0x00000079 mov dword ptr [ebp+122D1D01h], esi 0x0000007f popad 0x00000080 mov ebx, dword ptr [esp+24h] 0x00000084 mov dword ptr [ebp+122D1D01h], ecx 0x0000008a push eax 0x0000008b push ebx 0x0000008c pushad 0x0000008d push eax 0x0000008e pop eax 0x0000008f push eax 0x00000090 push edx 0x00000091 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0E49C second address: D0E4D0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8710ECC523h 0x00000007 jmp 00007F8710ECC51Dh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F8710ECC51Eh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D12870 second address: D12875 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D12B72 second address: D12B7E instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F8710ECC516h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D12CDD second address: D12CF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8710F1B5D0h 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D12CF4 second address: D12D29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F8710ECC516h 0x0000000a pop esi 0x0000000b jmp 00007F8710ECC527h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push ebx 0x00000014 jmp 00007F8710ECC51Ch 0x00000019 push eax 0x0000001a pop eax 0x0000001b pop ebx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D12EB2 second address: D12EC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8710F1B5D2h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D12EC9 second address: D12ECF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D16978 second address: D1697F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1697F second address: D16990 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e push eax 0x0000000f pop eax 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D16990 second address: D169E6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F8710F1B5D9h 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [eax] 0x0000000d jno 00007F8710F1B5E0h 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 pushad 0x00000018 jne 00007F8710F1B5C8h 0x0000001e pushad 0x0000001f popad 0x00000020 push eax 0x00000021 push edx 0x00000022 jnl 00007F8710F1B5C6h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D169E6 second address: D169EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D16B24 second address: D16B4E instructions: 0x00000000 rdtsc 0x00000002 je 00007F8710F1B5CCh 0x00000008 jnl 00007F8710F1B5C6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 add dword ptr [esp], 543742D8h 0x00000017 mov dword ptr [ebp+122D58D3h], ebx 0x0000001d lea ebx, dword ptr [ebp+124468C2h] 0x00000023 mov esi, eax 0x00000025 push eax 0x00000026 push eax 0x00000027 push eax 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D16BA2 second address: D16BA8 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D16BA8 second address: D16BCC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8710F1B5CCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jmp 00007F8710F1B5CAh 0x00000010 js 00007F8710F1B5CCh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D16BCC second address: D16C33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 push 00000000h 0x00000008 push ebx 0x00000009 call 00007F8710ECC518h 0x0000000e pop ebx 0x0000000f mov dword ptr [esp+04h], ebx 0x00000013 add dword ptr [esp+04h], 0000001Dh 0x0000001b inc ebx 0x0000001c push ebx 0x0000001d ret 0x0000001e pop ebx 0x0000001f ret 0x00000020 or dword ptr [ebp+122D38F4h], ecx 0x00000026 push 00000000h 0x00000028 jmp 00007F8710ECC51Ah 0x0000002d sub ecx, dword ptr [ebp+122D1C6Bh] 0x00000033 push 4BB0AD53h 0x00000038 push eax 0x00000039 push edx 0x0000003a pushad 0x0000003b jmp 00007F8710ECC525h 0x00000040 jng 00007F8710ECC516h 0x00000046 popad 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D16C33 second address: D16CBE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8710F1B5CDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 4BB0ADD3h 0x00000010 mov dword ptr [ebp+122D2824h], esi 0x00000016 push 00000003h 0x00000018 jp 00007F8710F1B5CAh 0x0000001e mov di, 4606h 0x00000022 push 00000000h 0x00000024 jl 00007F8710F1B5CCh 0x0000002a sub dword ptr [ebp+122D38B4h], edx 0x00000030 push edi 0x00000031 jbe 00007F8710F1B5C8h 0x00000037 mov esi, ecx 0x00000039 pop edi 0x0000003a push 00000003h 0x0000003c mov dword ptr [ebp+122D293Ah], ecx 0x00000042 push BCC3A693h 0x00000047 jmp 00007F8710F1B5D7h 0x0000004c xor dword ptr [esp], 7CC3A693h 0x00000053 mov dword ptr [ebp+122D2BB6h], edi 0x00000059 lea ebx, dword ptr [ebp+124468CBh] 0x0000005f mov edx, edi 0x00000061 push eax 0x00000062 pushad 0x00000063 jmp 00007F8710F1B5CAh 0x00000068 push eax 0x00000069 push edx 0x0000006a push eax 0x0000006b pop eax 0x0000006c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D16D7C second address: D16D86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F8710ECC516h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D16D86 second address: D16D98 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edi 0x0000000a jbe 00007F8710F1B5CCh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D16D98 second address: D16DD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 mov eax, dword ptr [esp+04h] 0x00000009 pushad 0x0000000a push edx 0x0000000b push edi 0x0000000c pop edi 0x0000000d pop edx 0x0000000e jmp 00007F8710ECC51Ch 0x00000013 popad 0x00000014 mov eax, dword ptr [eax] 0x00000016 jc 00007F8710ECC523h 0x0000001c jmp 00007F8710ECC51Dh 0x00000021 mov dword ptr [esp+04h], eax 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D16DD2 second address: D16DD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D16DD6 second address: D16DE0 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F8710ECC516h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D16DE0 second address: D16DE6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D16DE6 second address: D16DEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D16DEA second address: D16E54 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F8710F1B5C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop eax 0x0000000d push esi 0x0000000e mov edx, dword ptr [ebp+122D27D2h] 0x00000014 pop esi 0x00000015 mov edi, dword ptr [ebp+122D2BE3h] 0x0000001b push 00000003h 0x0000001d jmp 00007F8710F1B5D8h 0x00000022 push 00000000h 0x00000024 push 00000000h 0x00000026 push ecx 0x00000027 call 00007F8710F1B5C8h 0x0000002c pop ecx 0x0000002d mov dword ptr [esp+04h], ecx 0x00000031 add dword ptr [esp+04h], 00000016h 0x00000039 inc ecx 0x0000003a push ecx 0x0000003b ret 0x0000003c pop ecx 0x0000003d ret 0x0000003e push 00000003h 0x00000040 push ecx 0x00000041 mov esi, dword ptr [ebp+122D3BEDh] 0x00000047 pop ecx 0x00000048 push 62A042C0h 0x0000004d push eax 0x0000004e push edx 0x0000004f push eax 0x00000050 push edx 0x00000051 push eax 0x00000052 push edx 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D16E54 second address: D16E58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D16E58 second address: D16E5C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D16E5C second address: D16E62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D16E62 second address: D16ED1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8710F1B5D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 5D5FBD40h 0x00000010 pushad 0x00000011 mov dword ptr [ebp+122D38F4h], eax 0x00000017 mov ebx, dword ptr [ebp+122D39B1h] 0x0000001d popad 0x0000001e call 00007F8710F1B5CDh 0x00000023 add ecx, 05FC3DE1h 0x00000029 pop esi 0x0000002a lea ebx, dword ptr [ebp+124468D6h] 0x00000030 push 00000000h 0x00000032 push ebp 0x00000033 call 00007F8710F1B5C8h 0x00000038 pop ebp 0x00000039 mov dword ptr [esp+04h], ebp 0x0000003d add dword ptr [esp+04h], 00000015h 0x00000045 inc ebp 0x00000046 push ebp 0x00000047 ret 0x00000048 pop ebp 0x00000049 ret 0x0000004a xor si, BF0Ch 0x0000004f push eax 0x00000050 push eax 0x00000051 push edx 0x00000052 pushad 0x00000053 push ebx 0x00000054 pop ebx 0x00000055 push eax 0x00000056 pop eax 0x00000057 popad 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D36594 second address: D365A0 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F8710ECC516h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D365A0 second address: D365C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8710F1B5D6h 0x00000008 jmp 00007F8710F1B5CDh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D09250 second address: D09261 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8710ECC51Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D09261 second address: D09280 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8710F1B5D0h 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D09280 second address: D09297 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007F8710ECC522h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D09297 second address: D0929D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0929D second address: D092A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D092A3 second address: D092A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D092A7 second address: D092AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D092AB second address: D092C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jnc 00007F8710F1B5C6h 0x0000000d push esi 0x0000000e pop esi 0x0000000f jns 00007F8710F1B5C6h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D34690 second address: D346AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F8710ECC520h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D346AB second address: D346AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D346AF second address: D346B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D346B3 second address: D346B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D346B9 second address: D346CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jg 00007F8710ECC516h 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D346CA second address: D346D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D349AF second address: D349B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D349B5 second address: D349B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D349B9 second address: D349BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D349BD second address: D349DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F8710F1B5D8h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D34F74 second address: D34F98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop esi 0x00000007 jmp 00007F8710ECC520h 0x0000000c pushad 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f pushad 0x00000010 popad 0x00000011 jns 00007F8710ECC516h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D35387 second address: D3538D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3538D second address: D35391 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D354DE second address: D35507 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push eax 0x00000007 pop eax 0x00000008 jmp 00007F8710F1B5D0h 0x0000000d jmp 00007F8710F1B5D0h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3567B second address: D35681 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D35681 second address: D35698 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8710F1B5CAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a ja 00007F8710F1B5CEh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0C929 second address: D0C952 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F8710ECC534h 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0C952 second address: D0C958 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0C958 second address: D0C95E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D36171 second address: D3618F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8710F1B5D8h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3972D second address: D39731 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D39731 second address: D39737 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D39737 second address: D3973D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3973D second address: D39741 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D39741 second address: D3975C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edi 0x0000000a pushad 0x0000000b jmp 00007F8710ECC51Eh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D39C29 second address: D39C2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D384E1 second address: D38502 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F8710ECC526h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D38502 second address: D38508 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3C3E8 second address: D3C3F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F8710ECC516h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3C3F2 second address: D3C3FD instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3C3FD second address: D3C402 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3C402 second address: D3C407 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4100D second address: D4102C instructions: 0x00000000 rdtsc 0x00000002 ja 00007F8710ECC529h 0x00000008 push eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D05D00 second address: D05D04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D05D04 second address: D05D0E instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F8710ECC516h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D05D0E second address: D05D22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007F8710F1B5CEh 0x0000000c jp 00007F8710F1B5C6h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D40777 second address: D40781 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F8710ECC516h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D40BDC second address: D40BE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F8710F1B5C6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D42A63 second address: D42A69 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D42C9F second address: D42CA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D42F5D second address: D42F63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D42F63 second address: D42F67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4312D second address: D43131 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D43131 second address: D43149 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jmp 00007F8710F1B5CAh 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D43149 second address: D43153 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F8710ECC516h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D431EF second address: D431F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D431F3 second address: D43210 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F8710ECC525h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D43810 second address: D4383A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007F8710F1B5C6h 0x00000009 jmp 00007F8710F1B5D8h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4383A second address: D43841 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D43A7E second address: D43A88 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F8710F1B5C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D43A88 second address: D43A97 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8710ECC51Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D43C67 second address: D43C82 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 jmp 00007F8710F1B5CAh 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D43D43 second address: D43D51 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D43D51 second address: D43D6C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8710F1B5D7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D43D6C second address: D43D72 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D43D72 second address: D43D76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D44DF4 second address: D44E15 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F8710ECC528h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D44E15 second address: D44E1F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F8710F1B5C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D44E1F second address: D44E23 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D46AFA second address: D46B00 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4680F second address: D46813 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D46B00 second address: D46B06 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4760F second address: D47621 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnl 00007F8710ECC518h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D48B1E second address: D48B35 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8710F1B5D3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4954B second address: D4955B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c pop edx 0x0000000d push ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4E956 second address: D4E95A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4E95A second address: D4E960 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4E960 second address: D4E965 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D49F3B second address: D49F45 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F8710ECC516h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4FF5C second address: D4FF62 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D50F09 second address: D50F0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D50F0D second address: D50F13 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D50F13 second address: D50F17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D50F17 second address: D50F39 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F8710F1B5D6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D535AB second address: D535AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D510AE second address: D510B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D511A0 second address: D511A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D546DC second address: D546E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D546E0 second address: D546E6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D546E6 second address: D54786 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jbe 00007F8710F1B5E5h 0x0000000f pushad 0x00000010 jmp 00007F8710F1B5CCh 0x00000015 jmp 00007F8710F1B5D1h 0x0000001a popad 0x0000001b nop 0x0000001c call 00007F8710F1B5CCh 0x00000021 mov dword ptr [ebp+122D289Eh], esi 0x00000027 pop ebx 0x00000028 push 00000000h 0x0000002a jmp 00007F8710F1B5D4h 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push ebx 0x00000034 call 00007F8710F1B5C8h 0x00000039 pop ebx 0x0000003a mov dword ptr [esp+04h], ebx 0x0000003e add dword ptr [esp+04h], 00000014h 0x00000046 inc ebx 0x00000047 push ebx 0x00000048 ret 0x00000049 pop ebx 0x0000004a ret 0x0000004b pushad 0x0000004c mov eax, 53CCE721h 0x00000051 pushad 0x00000052 or esi, dword ptr [ebp+122D396Dh] 0x00000058 jmp 00007F8710F1B5D1h 0x0000005d popad 0x0000005e popad 0x0000005f push eax 0x00000060 jng 00007F8710F1B5E0h 0x00000066 pushad 0x00000067 push eax 0x00000068 push edx 0x00000069 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5376B second address: D5378B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8710ECC520h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jnl 00007F8710ECC51Ch 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5378B second address: D5378F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D53839 second address: D5383D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D57740 second address: D57754 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8710F1B5CEh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D557C8 second address: D557CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D55896 second address: D558A0 instructions: 0x00000000 rdtsc 0x00000002 je 00007F8710F1B5CCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D57CDC second address: D57D37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp], eax 0x00000008 push 00000000h 0x0000000a push edi 0x0000000b call 00007F8710ECC518h 0x00000010 pop edi 0x00000011 mov dword ptr [esp+04h], edi 0x00000015 add dword ptr [esp+04h], 0000001Dh 0x0000001d inc edi 0x0000001e push edi 0x0000001f ret 0x00000020 pop edi 0x00000021 ret 0x00000022 mov edi, dword ptr [ebp+122D35D5h] 0x00000028 mov edi, dword ptr [ebp+122D3A7Dh] 0x0000002e add edi, dword ptr [ebp+122D2F7Ch] 0x00000034 push 00000000h 0x00000036 sub ebx, dword ptr [ebp+122D58DFh] 0x0000003c push 00000000h 0x0000003e clc 0x0000003f push eax 0x00000040 push eax 0x00000041 push edx 0x00000042 pushad 0x00000043 je 00007F8710ECC516h 0x00000049 jc 00007F8710ECC516h 0x0000004f popad 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D57D37 second address: D57D49 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8710F1B5CDh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D58DE6 second address: D58E0B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jmp 00007F8710ECC51Fh 0x0000000f jmp 00007F8710ECC51Bh 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D58E0B second address: D58E11 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D57F62 second address: D57F66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D58E11 second address: D58E82 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F8710F1B5C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d mov dword ptr [ebp+122D3299h], eax 0x00000013 push 00000000h 0x00000015 mov ebx, dword ptr [ebp+122D3B0Dh] 0x0000001b push 00000000h 0x0000001d push 00000000h 0x0000001f push ebx 0x00000020 call 00007F8710F1B5C8h 0x00000025 pop ebx 0x00000026 mov dword ptr [esp+04h], ebx 0x0000002a add dword ptr [esp+04h], 0000001Ah 0x00000032 inc ebx 0x00000033 push ebx 0x00000034 ret 0x00000035 pop ebx 0x00000036 ret 0x00000037 pushad 0x00000038 add eax, dword ptr [ebp+122D284Bh] 0x0000003e je 00007F8710F1B5CCh 0x00000044 mov edx, dword ptr [ebp+122D28B1h] 0x0000004a popad 0x0000004b xchg eax, esi 0x0000004c jmp 00007F8710F1B5D7h 0x00000051 push eax 0x00000052 push eax 0x00000053 push edx 0x00000054 pushad 0x00000055 push eax 0x00000056 push edx 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D58E82 second address: D58E8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F8710ECC516h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D58E8D second address: D58E92 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D59DE5 second address: D59E89 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8710ECC522h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b jno 00007F8710ECC535h 0x00000011 nop 0x00000012 push 00000000h 0x00000014 push ebx 0x00000015 call 00007F8710ECC518h 0x0000001a pop ebx 0x0000001b mov dword ptr [esp+04h], ebx 0x0000001f add dword ptr [esp+04h], 00000015h 0x00000027 inc ebx 0x00000028 push ebx 0x00000029 ret 0x0000002a pop ebx 0x0000002b ret 0x0000002c push eax 0x0000002d cld 0x0000002e pop edi 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push ebp 0x00000034 call 00007F8710ECC518h 0x00000039 pop ebp 0x0000003a mov dword ptr [esp+04h], ebp 0x0000003e add dword ptr [esp+04h], 0000001Ah 0x00000046 inc ebp 0x00000047 push ebp 0x00000048 ret 0x00000049 pop ebp 0x0000004a ret 0x0000004b mov dword ptr [ebp+122D297Fh], edx 0x00000051 push 00000000h 0x00000053 jne 00007F8710ECC51Fh 0x00000059 cmc 0x0000005a push eax 0x0000005b jo 00007F8710ECC51Eh 0x00000061 push ebx 0x00000062 push eax 0x00000063 push edx 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D58FB6 second address: D58FBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D58FBB second address: D59048 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push ebp 0x0000000c call 00007F8710ECC518h 0x00000011 pop ebp 0x00000012 mov dword ptr [esp+04h], ebp 0x00000016 add dword ptr [esp+04h], 00000018h 0x0000001e inc ebp 0x0000001f push ebp 0x00000020 ret 0x00000021 pop ebp 0x00000022 ret 0x00000023 push dword ptr fs:[00000000h] 0x0000002a mov bx, di 0x0000002d mov dword ptr fs:[00000000h], esp 0x00000034 push 00000000h 0x00000036 push edi 0x00000037 call 00007F8710ECC518h 0x0000003c pop edi 0x0000003d mov dword ptr [esp+04h], edi 0x00000041 add dword ptr [esp+04h], 0000001Ch 0x00000049 inc edi 0x0000004a push edi 0x0000004b ret 0x0000004c pop edi 0x0000004d ret 0x0000004e mov dword ptr [ebp+122D334Dh], ebx 0x00000054 mov eax, dword ptr [ebp+122D0A45h] 0x0000005a stc 0x0000005b mov ebx, 0A8502F1h 0x00000060 push FFFFFFFFh 0x00000062 mov ebx, 2A10A97Eh 0x00000067 ja 00007F8710ECC51Ch 0x0000006d xor ebx, dword ptr [ebp+122D3C11h] 0x00000073 push eax 0x00000074 push eax 0x00000075 push eax 0x00000076 push edx 0x00000077 jns 00007F8710ECC516h 0x0000007d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D59048 second address: D5904C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5AEE0 second address: D5AEE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5AEE4 second address: D5AEEE instructions: 0x00000000 rdtsc 0x00000002 jo 00007F8710F1B5C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5CE6E second address: D5CE72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFF202 second address: CFF237 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8710F1B5D4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a js 00007F8710F1B5D9h 0x00000010 jmp 00007F8710F1B5D3h 0x00000015 push eax 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFF237 second address: CFF240 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFF240 second address: CFF244 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5F3ED second address: D5F3FD instructions: 0x00000000 rdtsc 0x00000002 je 00007F8710ECC51Ah 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5F3FD second address: D5F403 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5F403 second address: D5F407 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5F407 second address: D5F40B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D60961 second address: D60A13 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8710ECC528h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F8710ECC524h 0x0000000f nop 0x00000010 mov bl, 1Fh 0x00000012 push 00000000h 0x00000014 call 00007F8710ECC51Bh 0x00000019 add ebx, 3F3E5DD4h 0x0000001f pop ebx 0x00000020 push 00000000h 0x00000022 push 00000000h 0x00000024 push esi 0x00000025 call 00007F8710ECC518h 0x0000002a pop esi 0x0000002b mov dword ptr [esp+04h], esi 0x0000002f add dword ptr [esp+04h], 00000016h 0x00000037 inc esi 0x00000038 push esi 0x00000039 ret 0x0000003a pop esi 0x0000003b ret 0x0000003c jmp 00007F8710ECC520h 0x00000041 xchg eax, esi 0x00000042 pushad 0x00000043 push edx 0x00000044 jmp 00007F8710ECC520h 0x00000049 pop edx 0x0000004a jnl 00007F8710ECC52Ah 0x00000050 popad 0x00000051 push eax 0x00000052 jbe 00007F8710ECC520h 0x00000058 push eax 0x00000059 push edx 0x0000005a pushad 0x0000005b popad 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5FC00 second address: D5FC04 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5FC04 second address: D5FC0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D61ACC second address: D61AD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D61AD0 second address: D61AD4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D60BEC second address: D60BF1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D62BD9 second address: D62C0A instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F8710ECC516h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b nop 0x0000000c xor edi, 380360C3h 0x00000012 mov di, si 0x00000015 push 00000000h 0x00000017 mov dword ptr [ebp+122D2745h], esi 0x0000001d push 00000000h 0x0000001f pushad 0x00000020 push edi 0x00000021 mov cl, dl 0x00000023 pop ebx 0x00000024 mov dword ptr [ebp+124406EAh], edi 0x0000002a popad 0x0000002b xchg eax, esi 0x0000002c push edx 0x0000002d push eax 0x0000002e push edx 0x0000002f pushad 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D61CDB second address: D61CE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D62D9D second address: D62DA3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D62E43 second address: D62E5E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F8710F1B5D3h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D66DA0 second address: D66DBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8710ECC529h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D66DBE second address: D66DE1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 pushad 0x00000006 popad 0x00000007 jmp 00007F8710F1B5D6h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f push edi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6AF0C second address: D6AF13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6AF13 second address: D6AF35 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F8710F1B5CCh 0x00000008 jno 00007F8710F1B5C6h 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F8710F1B5D2h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6E28C second address: D6E290 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D72C84 second address: D72C88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D72C88 second address: D72CAB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 pop eax 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e jmp 00007F8710ECC51Bh 0x00000013 mov eax, dword ptr [eax] 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 push edi 0x00000019 pop edi 0x0000001a pushad 0x0000001b popad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D72CAB second address: D72CC1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edx 0x00000006 pop edx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edi 0x00000011 pop edi 0x00000012 pop eax 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D72CC1 second address: D72CC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D07733 second address: D07751 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8710F1B5CBh 0x00000009 popad 0x0000000a jnp 00007F8710F1B5D2h 0x00000010 jo 00007F8710F1B5C6h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D07751 second address: D0775A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0775A second address: D07766 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F8710F1B5C6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7905A second address: D79063 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D79063 second address: D79070 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jg 00007F8710F1B5CCh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D794BF second address: D794C4 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D794C4 second address: D794CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D794CA second address: D794E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 jl 00007F8710ECC53Fh 0x0000000d pushad 0x0000000e jbe 00007F8710ECC516h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D79B7E second address: D79B88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D79B88 second address: D79B9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 jmp 00007F8710ECC51Ah 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D79B9A second address: D79BA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7BED8 second address: D7BEDE instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7BEDE second address: D7BEFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F8710F1B5D6h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7BEFA second address: D7BF02 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 push esi 0x00000007 pop esi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7BF02 second address: D7BF06 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7BF06 second address: D7BF0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8272E second address: D82736 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D82736 second address: D8273B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8273B second address: D82743 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D82743 second address: D82747 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D82747 second address: D8274B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D815C5 second address: D815C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D815C9 second address: D815ED instructions: 0x00000000 rdtsc 0x00000002 jg 00007F8710F1B5C6h 0x00000008 jmp 00007F8710F1B5CEh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop ebx 0x00000010 push esi 0x00000011 push eax 0x00000012 push edx 0x00000013 jnp 00007F8710F1B5C6h 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8177D second address: D81783 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D81BC1 second address: D81BC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D81BC8 second address: D81BD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D81BD5 second address: D81BEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8710F1B5CEh 0x00000009 popad 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D81BEB second address: D81BF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F8710ECC516h 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D81D91 second address: D81D97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D81D97 second address: D81D9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D81D9B second address: D81DBF instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop ebx 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jg 00007F8710F1B5C6h 0x00000014 jmp 00007F8710F1B5D0h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D81DBF second address: D81DDD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F8710ECC524h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D81DDD second address: D81DE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D81DE1 second address: D81DE7 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D81DE7 second address: D81E0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F8710F1B5D8h 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D81F58 second address: D81F97 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8710ECC520h 0x00000007 jmp 00007F8710ECC528h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 jbe 00007F8710ECC518h 0x00000017 jo 00007F8710ECC51Eh 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D81F97 second address: D81F9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D81F9D second address: D81FAD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F8710ECC51Ah 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D81FAD second address: D81FCB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8710F1B5D6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D82114 second address: D82118 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D82118 second address: D8211C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8211C second address: D82122 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D82122 second address: D82193 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8710F1B5D2h 0x00000007 push eax 0x00000008 jmp 00007F8710F1B5D0h 0x0000000d jp 00007F8710F1B5C6h 0x00000013 pop eax 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 jmp 00007F8710F1B5CBh 0x0000001e jmp 00007F8710F1B5D1h 0x00000023 jmp 00007F8710F1B5CDh 0x00000028 popad 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007F8710F1B5D2h 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D82193 second address: D82197 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D82197 second address: D821A8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8710F1B5CDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D87242 second address: D87248 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D87248 second address: D8725A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jc 00007F8710F1B5C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8725A second address: D8727C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F8710ECC529h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edi 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8727C second address: D87282 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D87282 second address: D87288 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8751B second address: D87520 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8767A second address: D87680 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8E4C8 second address: D8E4D8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8710F1B5CCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8E4D8 second address: D8E4E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F8710ECC516h 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8E4E4 second address: D8E4E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4BEA2 second address: D4BEAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jnl 00007F8710ECC516h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4BEAF second address: D4BED2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a sub dword ptr [ebp+122D31C5h], edi 0x00000010 lea eax, dword ptr [ebp+1247BC91h] 0x00000016 mov di, si 0x00000019 nop 0x0000001a push ecx 0x0000001b jnp 00007F8710F1B5CCh 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4BED2 second address: D4BEF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F8710ECC528h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4C43C second address: D4C451 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8710F1B5D1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4C451 second address: BA3D84 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 add dword ptr [ebp+122D2819h], ebx 0x0000000f jmp 00007F8710ECC522h 0x00000014 push dword ptr [ebp+122D1395h] 0x0000001a mov ecx, esi 0x0000001c sbb ecx, 54DC3B7Fh 0x00000022 call dword ptr [ebp+122D28A3h] 0x00000028 pushad 0x00000029 mov dword ptr [ebp+122D1D01h], ebx 0x0000002f xor eax, eax 0x00000031 jmp 00007F8710ECC51Ah 0x00000036 mov edx, dword ptr [esp+28h] 0x0000003a add dword ptr [ebp+122D1D01h], esi 0x00000040 mov dword ptr [ebp+122D3AD1h], eax 0x00000046 jmp 00007F8710ECC526h 0x0000004b mov esi, 0000003Ch 0x00000050 pushad 0x00000051 jns 00007F8710ECC519h 0x00000057 call 00007F8710ECC521h 0x0000005c mov dword ptr [ebp+122D1D01h], eax 0x00000062 pop esi 0x00000063 popad 0x00000064 add esi, dword ptr [esp+24h] 0x00000068 jmp 00007F8710ECC528h 0x0000006d lodsw 0x0000006f jg 00007F8710ECC51Ch 0x00000075 add eax, dword ptr [esp+24h] 0x00000079 pushad 0x0000007a sub dword ptr [ebp+122D1D01h], ecx 0x00000080 mov dword ptr [ebp+122D1D01h], esi 0x00000086 popad 0x00000087 mov ebx, dword ptr [esp+24h] 0x0000008b mov dword ptr [ebp+122D1D01h], ecx 0x00000091 push eax 0x00000092 push ebx 0x00000093 pushad 0x00000094 push eax 0x00000095 pop eax 0x00000096 push eax 0x00000097 push edx 0x00000098 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4C62D second address: D4C632 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4C632 second address: D4C657 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8710ECC524h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a mov ecx, dword ptr [ebp+122D39D5h] 0x00000010 push eax 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 push edx 0x00000015 pop edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4C716 second address: D4C71B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4C99A second address: D4C9C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 jmp 00007F8710ECC51Eh 0x0000000e nop 0x0000000f mov ecx, dword ptr [ebp+122D2AFDh] 0x00000015 push 00000004h 0x00000017 mov edi, eax 0x00000019 nop 0x0000001a push eax 0x0000001b push edx 0x0000001c jc 00007F8710ECC51Ch 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4C9C7 second address: D4C9CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8E787 second address: D8E79F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jno 00007F8710ECC51Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8E79F second address: D8E7A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8E7A5 second address: D8E7A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8E8F3 second address: D8E911 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F8710F1B5CEh 0x00000008 pushad 0x00000009 popad 0x0000000a jp 00007F8710F1B5C6h 0x00000010 push eax 0x00000011 jmp 00007F8710F1B5CBh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8EA51 second address: D8EA5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop ebx 0x00000007 pop edx 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8EA5E second address: D8EA62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8EBB5 second address: D8EBCD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8710ECC524h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8F01B second address: D8F03E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007F8710F1B5C6h 0x00000009 jmp 00007F8710F1B5D8h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8F03E second address: D8F047 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8F047 second address: D8F04D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8F04D second address: D8F051 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8F051 second address: D8F076 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F8710F1B5D7h 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8F076 second address: D8F07C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8F07C second address: D8F082 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8F1DE second address: D8F1E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F8710ECC516h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D960BE second address: D960C3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D991C2 second address: D991DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 push eax 0x00000008 jmp 00007F8710ECC51Dh 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f pop eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D991DD second address: D99213 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F8710F1B5C6h 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007F8710F1B5D5h 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F8710F1B5CDh 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D99213 second address: D99217 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D99217 second address: D99225 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F8710F1B5C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D99225 second address: D9923B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8710ECC520h 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9923B second address: D9925D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007F8710F1B5C6h 0x00000009 jmp 00007F8710F1B5D7h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9925D second address: D99266 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D99266 second address: D9926A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D98BD7 second address: D98BE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push edx 0x00000007 pop edx 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D98BE0 second address: D98BEC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 ja 00007F8710F1B5C6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D98BEC second address: D98BF2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D98D79 second address: D98D7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D98D7F second address: D98D85 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D98D85 second address: D98D8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D98EDE second address: D98EE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D98EE2 second address: D98EE6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D98EE6 second address: D98EEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9EDED second address: D9EDF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9EDF2 second address: D9EDF8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9EDF8 second address: D9EDFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9EDFE second address: D9EE0C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8710ECC51Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9F093 second address: D9F0AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8710F1B5D3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9F0AA second address: D9F0AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9F0AE second address: D9F0D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F8710F1B5C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F8710F1B5D4h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9F0D0 second address: D9F0F0 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F8710ECC516h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007F8710ECC520h 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9F0F0 second address: D9F0F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9F0F6 second address: D9F101 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9F101 second address: D9F107 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9F3CA second address: D9F3FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edi 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f jno 00007F8710ECC518h 0x00000015 jmp 00007F8710ECC51Fh 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d je 00007F8710ECC51Ah 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9F3FD second address: D9F407 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F8710F1B5CCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4CB9B second address: D4CB9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4CB9F second address: D4CBA3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA37D8 second address: DA37E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA3939 second address: DA393D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA393D second address: DA396A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jl 00007F8710ECC522h 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 js 00007F8710ECC518h 0x00000017 push ecx 0x00000018 pop ecx 0x00000019 push edx 0x0000001a ja 00007F8710ECC516h 0x00000020 pop edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA396A second address: DA3970 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA3970 second address: DA397A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F8710ECC516h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA397A second address: DA3980 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA3D64 second address: DA3D68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA3EC5 second address: DA3EEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F8710F1B5C6h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d jmp 00007F8710F1B5CCh 0x00000012 popad 0x00000013 je 00007F8710F1B5D2h 0x00000019 pushad 0x0000001a push edi 0x0000001b pop edi 0x0000001c pushad 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA74C4 second address: DA74CD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push edi 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAF58F second address: DAF596 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAD62F second address: DAD650 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8710ECC51Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 ja 00007F8710ECC523h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAD650 second address: DAD65B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007F8710F1B5C6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAD8FC second address: DAD904 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DADEBA second address: DADEC2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAEA9D second address: DAEAA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAED1A second address: DAED3B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F8710F1B5D9h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAED3B second address: DAED3F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAF250 second address: DAF256 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAF256 second address: DAF25A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAF25A second address: DAF276 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jno 00007F8710F1B5C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F8710F1B5D0h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAF276 second address: DAF283 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jnl 00007F8710ECC516h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB276A second address: DB2770 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB2770 second address: DB2790 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jg 00007F8710ECC516h 0x0000000b pop edi 0x0000000c pushad 0x0000000d jg 00007F8710ECC516h 0x00000013 jmp 00007F8710ECC51Bh 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB28F1 second address: DB2904 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jbe 00007F8710F1B5C6h 0x0000000b jng 00007F8710F1B5C6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB2A2B second address: DB2A2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB2A2F second address: DB2A43 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnp 00007F8710F1B5C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jo 00007F8710F1B5C8h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB2EA3 second address: DB2EA7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB2EA7 second address: DB2EE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F8710F1B5CBh 0x0000000e jmp 00007F8710F1B5D7h 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 js 00007F8710F1B5C8h 0x0000001c push edx 0x0000001d pop edx 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB2EE0 second address: DB2EE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB7BA1 second address: DB7BA7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB7BA7 second address: DB7BE7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8710ECC528h 0x00000007 push ecx 0x00000008 push eax 0x00000009 pop eax 0x0000000a je 00007F8710ECC516h 0x00000010 pop ecx 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 jmp 00007F8710ECC51Ch 0x0000001b jnp 00007F8710ECC516h 0x00000021 popad 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB7BE7 second address: DB7BEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB7BEB second address: DB7BEF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB7BEF second address: DB7C06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8710F1B5D1h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB7C06 second address: DB7C19 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8710ECC51Eh 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBDE33 second address: DBDE37 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBE103 second address: DBE108 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBE108 second address: DBE10E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBE10E second address: DBE118 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F8710ECC516h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBE3C8 second address: DBE3CE instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBE68F second address: DBE6B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8710ECC51Ch 0x00000009 pop edx 0x0000000a jnl 00007F8710ECC51Ch 0x00000010 pop edx 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 pop eax 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBE6B4 second address: DBE6C5 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jg 00007F8710F1B5C6h 0x0000000d pop eax 0x0000000e push esi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBF5BD second address: DBF5E2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8710ECC51Dh 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F8710ECC521h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC806A second address: DC8070 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC8070 second address: DC8076 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC8076 second address: DC807F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC807F second address: DC80A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F8710ECC526h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ebx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC80A2 second address: DC80AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F8710F1B5C6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC80AE second address: DC80B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC80B9 second address: DC80BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC80BD second address: DC80C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD4CF4 second address: DD4D05 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F8710F1B5CCh 0x00000008 jne 00007F8710F1B5C6h 0x0000000e push ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD4D05 second address: DD4D27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8710ECC525h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f pushad 0x00000010 popad 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD6C53 second address: DD6C57 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD67CB second address: DD67D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F8710ECC516h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD693B second address: DD6941 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDA8DA second address: DDA8F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 jnl 00007F8710ECC516h 0x0000000f jmp 00007F8710ECC51Ch 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE1EF7 second address: DE1EFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE8B75 second address: DE8BB4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8710ECC51Fh 0x00000007 jns 00007F8710ECC516h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jmp 00007F8710ECC51Ch 0x00000015 jmp 00007F8710ECC527h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE8BB4 second address: DE8BBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE8BBA second address: DE8BCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 je 00007F8710ECC534h 0x0000000c push eax 0x0000000d push edx 0x0000000e jg 00007F8710ECC516h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE8BCE second address: DE8BDD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnl 00007F8710F1B5C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE899C second address: DE89A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F8710ECC516h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE89A8 second address: DE89AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE89AC second address: DE89D5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnl 00007F8710ECC52Ch 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE89D5 second address: DE89F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 jmp 00007F8710F1B5D7h 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE89F3 second address: DE89FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F8710ECC516h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF05F3 second address: DF05FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F8710F1B5C6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF05FF second address: DF0605 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF0605 second address: DF0623 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 jmp 00007F8710F1B5CDh 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e je 00007F8710F1B5C6h 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF0790 second address: DF079E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F8710ECC516h 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF079E second address: DF07A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF07A4 second address: DF07A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF07A8 second address: DF07AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF07AE second address: DF07B3 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF0A17 second address: DF0A21 instructions: 0x00000000 rdtsc 0x00000002 je 00007F8710F1B5C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF0A21 second address: DF0A32 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 jg 00007F8710ECC516h 0x0000000b popad 0x0000000c push ebx 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF0A32 second address: DF0A3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF0A3F second address: DF0A45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF0A45 second address: DF0A49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF0A49 second address: DF0A57 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F8710ECC516h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF0A57 second address: DF0A5B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF0A5B second address: DF0A61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF0E6F second address: DF0E89 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8710F1B5D5h 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF489E second address: DF48A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF48A2 second address: DF48A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF48A6 second address: DF48AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF48AC second address: DF48B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF48B2 second address: DF48BB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF43D8 second address: DF4413 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8710F1B5D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jbe 00007F8710F1B5CCh 0x0000000f jne 00007F8710F1B5C6h 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F8710F1B5D8h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E018A5 second address: E018B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F8710ECC516h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2A499 second address: E2A49D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2A49D second address: E2A4A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2A4A1 second address: E2A4AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2DF22 second address: E2DF42 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jo 00007F8710ECC516h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jne 00007F8710ECC522h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2E4BD second address: E2E4C3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2E4C3 second address: E2E4D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jp 00007F8710ECC516h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2E4D3 second address: E2E4EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jg 00007F8710F1B5D0h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2E66F second address: E2E68D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8710ECC529h 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2E68D second address: E2E693 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2E693 second address: E2E6B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jmp 00007F8710ECC522h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2E6B1 second address: E2E6C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F8710F1B5C6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2E6C0 second address: E2E6C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2E6C6 second address: E2E6D0 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F8710F1B5C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2E6D0 second address: E2E6D5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2E946 second address: E2E990 instructions: 0x00000000 rdtsc 0x00000002 js 00007F8710F1B5C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jne 00007F8710F1B5E4h 0x00000010 jnl 00007F8710F1B5C6h 0x00000016 jmp 00007F8710F1B5D8h 0x0000001b jmp 00007F8710F1B5D8h 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2E990 second address: E2E996 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2E996 second address: E2E99A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2E99A second address: E2E99E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2EAD9 second address: E2EADF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2EADF second address: E2EAE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E318F4 second address: E318F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E31990 second address: E319A3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8710ECC51Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E33007 second address: E3300D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E34D7F second address: E34D9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F8710ECC516h 0x0000000a jmp 00007F8710ECC525h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E34D9F second address: E34DDB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8710F1B5D4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jo 00007F8710F1B5D8h 0x00000011 pushad 0x00000012 popad 0x00000013 jmp 00007F8710F1B5D0h 0x00000018 js 00007F8710F1B5CEh 0x0000001e push edx 0x0000001f pop edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E34DDB second address: E34DDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E34DDF second address: E34DE4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4930D29 second address: 4930D38 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8710ECC51Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4930D38 second address: 4930D66 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8710F1B5D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jns 00007F8710F1B5EDh 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 mov bx, 270Eh 0x00000016 movsx edx, ax 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4930D66 second address: 4930DAE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, bx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b add eax, ecx 0x0000000d jmp 00007F8710ECC51Fh 0x00000012 mov eax, dword ptr [eax+00000860h] 0x00000018 jmp 00007F8710ECC526h 0x0000001d test eax, eax 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007F8710ECC51Ah 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4930DAE second address: 4930DB4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: BA3CF9 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: BA3DF3 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: D3830E instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: D65B7A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: D4BFD0 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: DC9609 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.1784649036.000000000068E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8
Source: file.exe, 00000000.00000003.1767142968.00000000006F6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1784798926.00000000006F6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B85BB0 LdrInitializeThunk,

0_2_00B85BB0

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: file.exe	String found in binary or memory: licendfilteo.site
Source: file.exe	String found in binary or memory: clearancek.site
Source: file.exe	String found in binary or memory: bathdoomgaz.stor
Source: file.exe	String found in binary or memory: spirittunek.stor
Source: file.exe	String found in binary or memory: dissapoiznw.stor
Source: file.exe	String found in binary or memory: studennotediw.stor
Source: file.exe	String found in binary or memory: mobbipenju.stor
Source: file.exe	String found in binary or memory: eaglepawnoy.stor

Source: file.exe, 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Process Injection	23 Virtualization/Sandbox Evasion	OS Credential Dumping	631 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	LSASS Memory	23 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	4 Obfuscated Files or Information	NTDS	23 System Information Discovery	Distributed Component Object Model	Input Capture	113 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://player.vimeo.com	0%	URL Reputation	safe
https://help.steampowered.com/en/	0%	URL Reputation	safe
https://store.steampowered.com/news/	0%	URL Reputation	safe
https://store.steampowered.com/subscriber_agreement/	0%	URL Reputation	safe
https://www.gstatic.cn/recaptcha/	0%	URL Reputation	safe
https://recaptcha.net/recaptcha/;	0%	URL Reputation	safe
http://www.valvesoftware.com/legal.htm	0%	URL Reputation	safe
https://store.steampowered.com/stats/	0%	URL Reputation	safe
https://medal.tv	0%	URL Reputation	safe
https://broadcast.st.dl.eccdnx.com	0%	URL Reputation	safe
https://store.steampowered.com/steam_refunds/	0%	URL Reputation	safe
https://login.steampowered.com/	0%	URL Reputation	safe
https://steam.tv/	0%	URL Reputation	safe
https://steamcommunity.com:443/profiles/76561199724331900	100%	URL Reputation	malware
https://store.steampowered.com/points/shop/	0%	URL Reputation	safe
https://recaptcha.net	0%	URL Reputation	safe
https://store.steampowered.com/	0%	URL Reputation	safe
https://lv.queniujq.cn	0%	URL Reputation	safe
https://store.steampowered.com/privacy_agreement/	0%	URL Reputation	safe
https://checkout.steampowered.com/	0%	URL Reputation	safe
https://help.steampowered.com/	0%	URL Reputation	safe
https://api.steampowered.com/	0%	URL Reputation	safe
https://store.steampowered.com/mobile	0%	URL Reputation	safe
https://store.steampowered.com/;	0%	URL Reputation	safe
https://store.steampowered.com/about/	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
steamcommunity.com	104.102.49.254	true	true	unknown
eaglepawnoy.store	unknown	unknown	true	unknown
bathdoomgaz.store	unknown	unknown	true	unknown
spirittunek.store	unknown	unknown	true	unknown
licendfilteo.site	unknown	unknown	true	unknown
studennotediw.store	unknown	unknown	true	unknown
mobbipenju.store	unknown	unknown	true	unknown
clearancek.site	unknown	unknown	true	unknown
dissapoiznw.store	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Reputation
bathdoomgaz.store	true	unknown
studennotediw.store	true	unknown
clearancek.site	true	unknown
dissapoiznw.store	true	unknown
https://steamcommunity.com/profiles/76561199724331900	true	unknown
spirittunek.store	true	unknown
licendfilteo.site	true	unknown
eaglepawnoy.store	true	unknown
mobbipenju.store	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://steamcommunity.com/UW	file.exe, 00000000.00000002.1784736653.00000000006D8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766910824.00000000006D8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/my/wishlist/	file.exe, 00000000.00000003.1766617252.0000000000748000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766617252.0000000000742000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766910824.00000000006C9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://player.vimeo.com	file.exe, 00000000.00000003.1766910824.0000000000731000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1784835994.0000000000731000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C0e3d185a3e106e7	file.exe, 00000000.00000003.1766910824.0000000000731000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL&l=	file.exe, 00000000.00000003.1766617252.0000000000748000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766617252.0000000000742000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/?subsection=broadcasts	file.exe, 00000000.00000003.1766617252.0000000000748000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766617252.0000000000742000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1784649036.00000000006C5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766910824.00000000006C9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://help.steampowered.com/en/	file.exe, 00000000.00000003.1766617252.0000000000748000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766617252.0000000000742000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1784649036.00000000006C5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766910824.00000000006C9000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/market/	file.exe, 00000000.00000003.1766617252.0000000000748000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766617252.0000000000742000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1784649036.00000000006C5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766910824.00000000006C9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/news/	file.exe, 00000000.00000003.1766617252.0000000000748000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766617252.0000000000742000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766910824.00000000006C9000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.steamstatic.com/public/shared/css/motiva_sans.css?v=v7XTmVzbLV33&l=english	file.exe, 00000000.00000003.1766617252.0000000000748000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766617252.0000000000742000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.steamstatic.com/public/javascript/global.js?v=7qlUmHSJhPRN&l=english	file.exe, 00000000.00000003.1766617252.0000000000748000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766617252.0000000000742000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.steamstatic.com/public/css/globalv2.css?v=dQy8Omh4p9PH&l=english	file.exe, 00000000.00000003.1766617252.0000000000748000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766617252.0000000000742000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/subscriber_agreement/	file.exe, 00000000.00000003.1766617252.0000000000748000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766617252.0000000000742000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1784649036.00000000006C5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.gstatic.cn/recaptcha/	file.exe, 00000000.00000003.1766910824.0000000000731000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1784835994.0000000000731000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://recaptcha.net/recaptcha/;	file.exe, 00000000.00000003.1766910824.0000000000731000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1784835994.0000000000731000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.valvesoftware.com/legal.htm	file.exe, 00000000.00000003.1766617252.0000000000748000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766617252.0000000000742000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1784649036.00000000006C5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/discussions/	file.exe, 00000000.00000003.1766617252.0000000000748000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766617252.0000000000742000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1784649036.00000000006C5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766910824.00000000006C9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.youtube.com	file.exe, 00000000.00000003.1766910824.0000000000731000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1784835994.0000000000731000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.google.com	file.exe, 00000000.00000003.1766910824.0000000000731000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1784835994.0000000000731000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/stats/	file.exe, 00000000.00000003.1766617252.0000000000748000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766617252.0000000000742000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766910824.00000000006C9000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://medal.tv	file.exe, 00000000.00000003.1766910824.0000000000731000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1784835994.0000000000731000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://broadcast.st.dl.eccdnx.com	file.exe, 00000000.00000003.1766910824.0000000000731000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1784835994.0000000000731000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/steam_refunds/	file.exe, 00000000.00000003.1766617252.0000000000748000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766617252.0000000000742000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1784649036.00000000006C5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	file.exe, 00000000.00000003.1766617252.0000000000748000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766617252.0000000000742000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1784649036.00000000006C5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0	file.exe, 00000000.00000003.1766617252.0000000000748000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766617252.0000000000742000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.steamstatic.com/public/shared/css/buttons.css?v=-WV9f1LdxEjq&l=english	file.exe, 00000000.00000003.1766617252.0000000000748000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766617252.0000000000742000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900	file.exe, 00000000.00000003.1766617252.0000000000742000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766910824.00000000006C9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/	file.exe, 00000000.00000003.1766910824.0000000000731000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1784835994.0000000000731000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.steamstatic.com/	file.exe, 00000000.00000002.1784835994.0000000000731000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://s.ytimg.com;	file.exe, 00000000.00000003.1766910824.0000000000731000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1784835994.0000000000731000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/workshop/	file.exe, 00000000.00000003.1766617252.0000000000748000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766617252.0000000000742000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1784649036.00000000006C5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766910824.00000000006C9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://login.steampowered.com/	file.exe, 00000000.00000002.1784835994.0000000000731000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.steamstatic.com/public/shared/images/responsive/header_logo.png	file.exe, 00000000.00000003.1766617252.0000000000748000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766617252.0000000000742000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766910824.00000000006C9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://eaglepawnoy.store:443/api	file.exe, 00000000.00000002.1784736653.00000000006CF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766910824.00000000006CF000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steam.tv/	file.exe, 00000000.00000003.1766910824.0000000000731000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1784835994.0000000000731000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	file.exe, 00000000.00000003.1766617252.0000000000748000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766617252.0000000000742000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766910824.00000000006C9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://cdn.fastly	file.exe	false		unknown
https://steamcommunity.c	file.exe, 00000000.00000003.1766617252.0000000000742000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC	file.exe, 00000000.00000003.1766617252.0000000000748000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766617252.0000000000742000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.steamstatic.com/public/css/skin_1/header.css?v=pTvrRy1pm52p&l=english	file.exe, 00000000.00000003.1766617252.0000000000748000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766617252.0000000000742000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com:443/profiles/76561199724331900	file.exe, 00000000.00000002.1784736653.00000000006CF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766910824.00000000006CF000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
https://store.steampowered.com/points/shop/	file.exe, 00000000.00000003.1766617252.0000000000748000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766617252.0000000000742000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766910824.00000000006C9000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://recaptcha.net	file.exe, 00000000.00000003.1766910824.0000000000731000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1784835994.0000000000731000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/	file.exe, 00000000.00000003.1766910824.00000000006C9000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://recaptcha.ne	file.exe	false		unknown
https://community.steamstatic.com/public/shared/javascript/shared_global.js?v=7glT1n_nkVCs&l=eng	file.exe, 00000000.00000003.1766617252.0000000000748000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766617252.0000000000742000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://sketchfab.com	file.exe, 00000000.00000003.1766910824.0000000000731000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1784835994.0000000000731000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://lv.queniujq.cn	file.exe, 00000000.00000003.1766910824.0000000000731000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1784835994.0000000000731000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://mobbipenju.store:443/api	file.exe, 00000000.00000002.1784736653.00000000006CF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766910824.00000000006CF000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.youtube.com/	file.exe, 00000000.00000003.1766910824.0000000000731000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1784835994.0000000000731000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://127.0.0.1:27060	file.exe, 00000000.00000003.1766910824.0000000000731000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1784835994.0000000000731000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.steamstatic.com/public/shared/css/shared_global.css?v=uF6G1wyNU-4c&l=english	file.exe, 00000000.00000003.1766617252.0000000000748000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766617252.0000000000742000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	file.exe, 00000000.00000003.1766617252.0000000000748000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766617252.0000000000742000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766910824.00000000006C9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/privacy_agreement/	file.exe, 00000000.00000003.1766617252.0000000000748000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766617252.0000000000742000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1784649036.00000000006C5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://clearancek.site:443/apii	file.exe, 00000000.00000002.1784736653.00000000006CF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766910824.00000000006CF000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1&l=engl	file.exe, 00000000.00000003.1766617252.0000000000748000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766617252.0000000000742000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.google.com/recaptcha/	file.exe, 00000000.00000002.1784835994.0000000000731000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://checkout.steampowered.com/	file.exe, 00000000.00000002.1784835994.0000000000731000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw	file.exe, 00000000.00000003.1766617252.0000000000748000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766617252.0000000000742000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://dissapoiznw.store:443/apibcryptPrimitives.dllv	file.exe, 00000000.00000002.1784736653.00000000006CF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766910824.00000000006CF000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://help.steampowered.com/	file.exe, 00000000.00000002.1784835994.0000000000731000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.steampowered.com/	file.exe, 00000000.00000002.1784835994.0000000000731000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.steamstatic.com/public/css/skin_1/fatalerror.css?v=wctRWaBvNt2z&l=english	file.exe, 00000000.00000003.1766617252.0000000000748000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766617252.0000000000742000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSvIAKtunf	file.exe, 00000000.00000003.1766617252.0000000000748000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766617252.0000000000742000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.steamstatic.com/public/shared/css/shared_responsive.css?v=kR9MtmbWSZEp&l=engli	file.exe, 00000000.00000003.1766617252.0000000000748000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766617252.0000000000742000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/mobile	file.exe, 00000000.00000003.1766617252.0000000000748000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766617252.0000000000742000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1784649036.00000000006C5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/	file.exe, 00000000.00000003.1766910824.00000000006C9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://127.0.0	file.exe	false		unknown
https://store.steampowered.com/;	file.exe, 00000000.00000003.1766910824.0000000000731000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1784835994.0000000000731000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/about/	file.exe, 00000000.00000003.1766910824.00000000006C9000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.102.49.254	steamcommunity.com	United States		16625	AKAMAI-ASUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1538174
Start date and time:	2024-10-20 18:12:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	1
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@9/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: file.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.102.49.254	http://gtm-cn-j4g3qqvf603.steamproxy1.com/	Get hash	malicious	Unknown	Browse	www.valvesoftware.com/legal.htm

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
steamcommunity.com	Unlock_Tool_2.3.1.exe	Get hash	malicious	Vidar	Browse	104.102.49.254
	WinFIG.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	WinFIG-2024.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	SentinelOculus.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	Download.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASUS	Unlock_Tool_2.3.1.exe	Get hash	malicious	Vidar	Browse	104.102.49.254
	WinFIG.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	WinFIG-2024.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	SentinelOculus.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	Download.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	WinFIG.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	WinFIG-2024.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	SentinelOculus.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	Download.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	Aquantia.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.5279296597536955
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'920'448 bytes
MD5:	bb625c966762131e9418f761c448fdd3
SHA1:	95e0213ce710abaceb2c0aecfb217aa7b0ac2bcc
SHA256:	99a54271b35fd2c3db30fa506be8c72011031d445dd2f28aeedddceebdde5c64
SHA512:	0f25cd4ba22ab24397305653e0af6742e8941f088995a233a6785e5048129548f093b7842446d173930b40f69eaa6b0c1f45aebe0f41e5f0ad5664a09c9f6954
SSDEEP:	49152:YxfX0Nh7FaQMgLlgNHb+iUghtGckIfYfz:88rFa3glgNH95DGef0z
TLSH:	98D53BA1B809B6CBD4AE1774F527CD82682D47F5472048CBE86DA47DBFA3CC015BAC64
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...J..f..............................0...........@..........................@0.....%.,...@.................................W...k..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x701000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66FFF14A [Fri Oct 4 13:44:42 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F871126A27Ah
movd mm5, dword ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F871126C275h
add byte ptr [edi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx+ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], cl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or byte ptr [eax+00000000h], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], bl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5f057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x5f1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x5d000	0x25e00	8f4f8270535d421fce1c6bf9bf192ab4	False	0.9993618502475248	data	7.975536297032172	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x5e000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x5f000	0x1000	0x200	fe72def8b74193a84232a780098a7ce0	False	0.150390625	data	1.04205214219471	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
hgfldvor	0x60000	0x2a0000	0x29fa00	2bfce13f104de94dbd1fba0e04dc12ed	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
xsdmkczw	0x300000	0x1000	0x400	8998af4ae651e0ac24dcc55d3a1f0701	False	0.75390625	data	5.972346098631579	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x301000	0x3000	0x2200	3bd634b24a0b87d2f23db25c09ab1170	False	0.06629136029411764	DOS executable (COM)	0.8182228023857201	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-20T18:13:04.022551+0200	2056471	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)	1	192.168.2.4	59249	1.1.1.1	53	UDP
2024-10-20T18:13:04.032785+0200	2056485	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)	1	192.168.2.4	60218	1.1.1.1	53	UDP
2024-10-20T18:13:04.049074+0200	2056483	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)	1	192.168.2.4	50148	1.1.1.1	53	UDP
2024-10-20T18:13:04.060823+0200	2056481	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)	1	192.168.2.4	58198	1.1.1.1	53	UDP
2024-10-20T18:13:04.079249+0200	2056479	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)	1	192.168.2.4	53659	1.1.1.1	53	UDP
2024-10-20T18:13:04.090889+0200	2056477	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)	1	192.168.2.4	56895	1.1.1.1	53	UDP
2024-10-20T18:13:04.102298+0200	2056475	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)	1	192.168.2.4	61510	1.1.1.1	53	UDP
2024-10-20T18:13:04.117140+0200	2056473	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)	1	192.168.2.4	50736	1.1.1.1	53	UDP
2024-10-20T18:13:07.017617+0200	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.4	49730	104.102.49.254	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 20, 2024 18:13:04.148686886 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 20, 2024 18:13:04.148755074 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 20, 2024 18:13:04.148830891 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 20, 2024 18:13:04.152704000 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 20, 2024 18:13:04.152745008 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 20, 2024 18:13:06.274804115 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 20, 2024 18:13:06.274888992 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 20, 2024 18:13:06.278542995 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 20, 2024 18:13:06.278573036 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 20, 2024 18:13:06.278879881 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 20, 2024 18:13:06.318850040 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 20, 2024 18:13:06.327296019 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 20, 2024 18:13:06.367436886 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 20, 2024 18:13:07.017659903 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 20, 2024 18:13:07.017680883 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 20, 2024 18:13:07.017719984 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 20, 2024 18:13:07.017741919 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 20, 2024 18:13:07.017781973 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 20, 2024 18:13:07.017896891 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 20, 2024 18:13:07.017896891 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 20, 2024 18:13:07.017952919 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 20, 2024 18:13:07.018008947 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 20, 2024 18:13:07.019031048 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 20, 2024 18:13:07.019079924 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 20, 2024 18:13:07.019134045 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 20, 2024 18:13:07.100629091 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 20, 2024 18:13:07.100677967 CEST	443	49730	104.102.49.254	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 20, 2024 18:13:04.022551060 CEST	59249	53	192.168.2.4	1.1.1.1
Oct 20, 2024 18:13:04.031667948 CEST	53	59249	1.1.1.1	192.168.2.4
Oct 20, 2024 18:13:04.032784939 CEST	60218	53	192.168.2.4	1.1.1.1
Oct 20, 2024 18:13:04.041500092 CEST	53	60218	1.1.1.1	192.168.2.4
Oct 20, 2024 18:13:04.049073935 CEST	50148	53	192.168.2.4	1.1.1.1
Oct 20, 2024 18:13:04.059294939 CEST	53	50148	1.1.1.1	192.168.2.4
Oct 20, 2024 18:13:04.060822964 CEST	58198	53	192.168.2.4	1.1.1.1
Oct 20, 2024 18:13:04.077653885 CEST	53	58198	1.1.1.1	192.168.2.4
Oct 20, 2024 18:13:04.079248905 CEST	53659	53	192.168.2.4	1.1.1.1
Oct 20, 2024 18:13:04.089417934 CEST	53	53659	1.1.1.1	192.168.2.4
Oct 20, 2024 18:13:04.090888977 CEST	56895	53	192.168.2.4	1.1.1.1
Oct 20, 2024 18:13:04.099922895 CEST	53	56895	1.1.1.1	192.168.2.4
Oct 20, 2024 18:13:04.102298021 CEST	61510	53	192.168.2.4	1.1.1.1
Oct 20, 2024 18:13:04.114751101 CEST	53	61510	1.1.1.1	192.168.2.4
Oct 20, 2024 18:13:04.117140055 CEST	50736	53	192.168.2.4	1.1.1.1
Oct 20, 2024 18:13:04.129278898 CEST	53	50736	1.1.1.1	192.168.2.4
Oct 20, 2024 18:13:04.133429050 CEST	51614	53	192.168.2.4	1.1.1.1
Oct 20, 2024 18:13:04.141642094 CEST	53	51614	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 20, 2024 18:13:04.022551060 CEST	192.168.2.4	1.1.1.1	0x2be2	Standard query (0)	clearancek.site	A (IP address)	IN (0x0001)	false
Oct 20, 2024 18:13:04.032784939 CEST	192.168.2.4	1.1.1.1	0xfd3a	Standard query (0)	mobbipenju.store	A (IP address)	IN (0x0001)	false
Oct 20, 2024 18:13:04.049073935 CEST	192.168.2.4	1.1.1.1	0x9308	Standard query (0)	eaglepawnoy.store	A (IP address)	IN (0x0001)	false
Oct 20, 2024 18:13:04.060822964 CEST	192.168.2.4	1.1.1.1	0x3776	Standard query (0)	dissapoiznw.store	A (IP address)	IN (0x0001)	false
Oct 20, 2024 18:13:04.079248905 CEST	192.168.2.4	1.1.1.1	0x3ace	Standard query (0)	studennotediw.store	A (IP address)	IN (0x0001)	false
Oct 20, 2024 18:13:04.090888977 CEST	192.168.2.4	1.1.1.1	0xea41	Standard query (0)	bathdoomgaz.store	A (IP address)	IN (0x0001)	false
Oct 20, 2024 18:13:04.102298021 CEST	192.168.2.4	1.1.1.1	0xfa2	Standard query (0)	spirittunek.store	A (IP address)	IN (0x0001)	false
Oct 20, 2024 18:13:04.117140055 CEST	192.168.2.4	1.1.1.1	0x5be1	Standard query (0)	licendfilteo.site	A (IP address)	IN (0x0001)	false
Oct 20, 2024 18:13:04.133429050 CEST	192.168.2.4	1.1.1.1	0xab58	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 20, 2024 18:13:04.031667948 CEST	1.1.1.1	192.168.2.4	0x2be2	Name error (3)	clearancek.site	none	none	A (IP address)	IN (0x0001)	false
Oct 20, 2024 18:13:04.041500092 CEST	1.1.1.1	192.168.2.4	0xfd3a	Name error (3)	mobbipenju.store	none	none	A (IP address)	IN (0x0001)	false
Oct 20, 2024 18:13:04.059294939 CEST	1.1.1.1	192.168.2.4	0x9308	Name error (3)	eaglepawnoy.store	none	none	A (IP address)	IN (0x0001)	false
Oct 20, 2024 18:13:04.077653885 CEST	1.1.1.1	192.168.2.4	0x3776	Name error (3)	dissapoiznw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 20, 2024 18:13:04.089417934 CEST	1.1.1.1	192.168.2.4	0x3ace	Name error (3)	studennotediw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 20, 2024 18:13:04.099922895 CEST	1.1.1.1	192.168.2.4	0xea41	Name error (3)	bathdoomgaz.store	none	none	A (IP address)	IN (0x0001)	false
Oct 20, 2024 18:13:04.114751101 CEST	1.1.1.1	192.168.2.4	0xfa2	Name error (3)	spirittunek.store	none	none	A (IP address)	IN (0x0001)	false
Oct 20, 2024 18:13:04.129278898 CEST	1.1.1.1	192.168.2.4	0x5be1	Name error (3)	licendfilteo.site	none	none	A (IP address)	IN (0x0001)	false
Oct 20, 2024 18:13:04.141642094 CEST	1.1.1.1	192.168.2.4	0xab58	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	104.102.49.254	443	3632	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-20 16:13:06 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-10-20 16:13:07 UTC	1891	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://ste [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Sun, 20 Oct 2024 16:13:06 GMT Content-Length: 25258 Connection: close Set-Cookie: sessionid=033b555b211399fccfe192b4; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C0e3d185a3e106e73b244decdec33a0ea; Path=/; Secure; HttpOnly; SameSite=None
2024-10-20 16:13:07 UTC	14493	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><

Target ID:	0
Start time:	12:13:01
Start date:	20/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xb40000
File size:	2'920'448 bytes
MD5 hash:	BB625C966762131E9418F761C448FDD3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	56.2%
Total number of Nodes:	48
Total number of Limit Nodes:	6

Executed Functions

Function 00B850FA Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 63
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(19A41BB1,00000000,00000800), ref: 00B85182

Strings

<I$), xrefs: 00B852E3
<I$), xrefs: 00B85198
@^, xrefs: 00B85120

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID: LibraryLoad
String ID: <I$)$<I$)$@^
API String ID: 1029625771-935358343
Opcode ID: f6258864f460db9b1c5549aba028a7ec5ac24e3cbf6db0638eda0ce1cb766bb2
Instruction ID: eb5642905edf6586754210bcbc19b917c0a2462fffeedf201bb81124a868d33c
Opcode Fuzzy Hash: f6258864f460db9b1c5549aba028a7ec5ac24e3cbf6db0638eda0ce1cb766bb2
Instruction Fuzzy Hash: E7219D3510C3848FC310EF68D881B2AB7F4AB6A300F69482CE1C5D7362DB36DA15CB56

Function 00B4FCA0 Relevance: 5.4, Strings: 4, Instructions: 373
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

VY^_, xrefs: 00B4FDFF
V, xrefs: 00B4FEDC
t, xrefs: 00B4FCBE
J|BJ, xrefs: 00B5000D

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID: J|BJ$V$VY^_$t
API String ID: 0-3701112211
Opcode ID: 93be9f8510c8c355e4f43b7018ef1191ea9c665d4109ccdc4a5d212aff328f1c
Instruction ID: 1db98fb4e44c2b0e6519bf96fcd00164d776a43d871f7483611e90c6d403119d
Opcode Fuzzy Hash: 93be9f8510c8c355e4f43b7018ef1191ea9c665d4109ccdc4a5d212aff328f1c
Instruction Fuzzy Hash: 93D167745193819BD311EF148490B2FBBE1EB96B45F1888ACF8C99B252C335CD09EB93

Function 00B4D110 Relevance: 1.7, APIs: 1, Instructions: 168
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(00000000), ref: 00B4D2F1

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 82b4bbfb99972bc7ce95dbb06c2110d2840a0bc289fcde6782ff6dd0d12b3572
Instruction ID: 26073a29db0723150bca0287d01c9da602e29b26bc69394385f35914317fa72a
Opcode Fuzzy Hash: 82b4bbfb99972bc7ce95dbb06c2110d2840a0bc289fcde6782ff6dd0d12b3572
Instruction Fuzzy Hash: D741437050D380ABD701BB68D584A2EFBF5EF92705F148C9CE5C497212C33AD914AB6B

Function 00B85BB0 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(00B8973D,005C003F,00000006,?,?,00000018,8C8D8A8B,?,?), ref: 00B85BDE

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction ID: fb6f357373f259be8b0e83fffc5d2a3912a28e0da7d2036ce94b71e982b3a7e9
Opcode Fuzzy Hash: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction Fuzzy Hash: 76E0FE75908316AB9A09CF45C14444EFBE5BFC4714F11CC8DA4D867210D3B0AD46DF82

Function 00B8695B Relevance: 1.4, Strings: 1, Instructions: 100
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@, xrefs: 00B869C5

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 0b56324a233e5bf3d29223212ea91bde7310e265b0fd3797ad7ff94e34d483a1
Instruction ID: a1f48708ba75be4e5909c44492eac51fe07d75c48d0bcc4dea970c4e4db2c783
Opcode Fuzzy Hash: 0b56324a233e5bf3d29223212ea91bde7310e265b0fd3797ad7ff94e34d483a1
Instruction Fuzzy Hash: A531A8B15183018FD718EF14C8A0B2AB7F1FF94344F48986DE5C6A72A1E7399904CB56

Function 00B5049B Relevance: .3, Instructions: 264
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 248075b96aa0601890d8e4274946d4d451080833a163bdcd637bfb0e1ec91a44
Instruction ID: 2fc42e2dba5b13d7ac524ac9a1b2fbf01558602324e36319d10f2a9ba68eaf24
Opcode Fuzzy Hash: 248075b96aa0601890d8e4274946d4d451080833a163bdcd637bfb0e1ec91a44
Instruction Fuzzy Hash: 90918975200B01CFD724CF25E890B26B7F6FF89315F118AADE8568BAA1DB31E815CB50

Function 00B50228 Relevance: .2, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89da3918fe923e7995f2d7561fdb98f331cb5eb5b8ce668cc7cf60907a5d00ca
Instruction ID: d5d984cf60f4208f8e07b58f62dca6f7e4fd6c0e3ceeb9785bdca4fc96f0dd4a
Opcode Fuzzy Hash: 89da3918fe923e7995f2d7561fdb98f331cb5eb5b8ce668cc7cf60907a5d00ca
Instruction Fuzzy Hash: 90717974204701DFD7249F21EC94B26B7F6FF8A315F1089ADE8468B662CB31E819CB60

Function 00B899D0 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59cb256ef73b49699661d7e0366f067738c572d7caf463a3fc4684a0bbac922c
Instruction ID: de99822d6ff0a2e45da5accc1fa3b742a0f453dd9fcd02ad4319402b433a6735
Opcode Fuzzy Hash: 59cb256ef73b49699661d7e0366f067738c572d7caf463a3fc4684a0bbac922c
Instruction Fuzzy Hash: 30418034248300ABDB24EF55D990B3BF7E5EB85714F5888ADF58A97261D335EC01CB62

Function 00B863B8 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: dfcc419eb0ecc63c459b993887fc3c81e067917da535dd0a5a441103ae9044e7
Instruction ID: 4821095b8c32b1e6458eff6d919acbd1e936c0648d28897aca38912b13c4b812
Opcode Fuzzy Hash: dfcc419eb0ecc63c459b993887fc3c81e067917da535dd0a5a441103ae9044e7
Instruction Fuzzy Hash: A431C170649301BAD624EA08CE82F2EB7E5EB90B11F688548F1816B2E1D770AC11CB56

Function 00B50EEC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1cf76d2e6f71ff0fc4bb053a3b1d5d8f574ff39866f504e64ba70e9c3576125
Instruction ID: 8041e07e99b6f0bb475e0d78efdeeddc2069f6256cead4d09f5e8aaae3ccd147
Opcode Fuzzy Hash: a1cf76d2e6f71ff0fc4bb053a3b1d5d8f574ff39866f504e64ba70e9c3576125
Instruction Fuzzy Hash: 53213DB490021A9FDB15DF94CC90BBEBBB1FF46305F144899E811BB391C735A915CB64

Function 00B83220 Relevance: 1.6, APIs: 1, Instructions: 59
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(?,00000000), ref: 00B832A6

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: d623fe52fa379752d72df8be366caa4a719c8e56c5ad9e249f257cb07de2b6fe
Instruction ID: f02c8a16123395903e851027d11a1f57d9ddd59dd585ccd8c507eded07cd096a
Opcode Fuzzy Hash: d623fe52fa379752d72df8be366caa4a719c8e56c5ad9e249f257cb07de2b6fe
Instruction Fuzzy Hash: 9E01693450D2409BC701EF18E989A1ABBE8EF4AB00F05895CE5C98B361D739DD60CBA6

Function 00B83202 Relevance: 1.5, APIs: 1, Instructions: 6
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,00000000), ref: 00B83208

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 47c8a9813d6b9fa52210b55aadcfbf4bbbfe6d0f649073bf1b9c7ac9517f39e8
Instruction ID: 092b12cefb886cf650042234b81bcab6512423c195567c46bfe5aac4bfcc1c74
Opcode Fuzzy Hash: 47c8a9813d6b9fa52210b55aadcfbf4bbbfe6d0f649073bf1b9c7ac9517f39e8
Instruction Fuzzy Hash: 70B012301400005FDA041B00FC0AF003510EB00605F800050A100050B1D5655C64C554

Non-executed Functions

Function 00B5DB6F Relevance: 32.0, Strings: 24, Instructions: 2006COMMON

Download Yara Rule

Strings

<=2, xrefs: 00B5EA01
lkji, xrefs: 00B5E73E
tuJK, xrefs: 00B5E967
89&', xrefs: 00B5E93B
tsrq, xrefs: 00B5E6FC
89>?, xrefs: 00B5E9F6
D, xrefs: 00B5E846
dcba, xrefs: 00B5E728
:WUE, xrefs: 00B5F6B7, 00B5F6C6
AR, xrefs: 00B5DD10
%*+(, xrefs: 00B5DE37, 00B5DE46
T, xrefs: 00B5F157
mjkh, xrefs: 00B5E7D8
`Y^_, xrefs: 00B5E99E
<=:;, xrefs: 00B5E930
DCBA, xrefs: 00B5E887, 00B5E896
@ONM, xrefs: 00B5E6DB
QNOL, xrefs: 00B5E775
LKJI, xrefs: 00B5E6E6
xgfe, xrefs: 00B5E71D
WP, xrefs: 00B5DCEF
|, xrefs: 00B5ECB1
`onm, xrefs: 00B5E733
()./, xrefs: 00B5E9CA

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID: InitializeThunk
String ID: %*+($()./$89&'$89>?$:WUE$<=2$<=:;$@ONM$AR$D$DCBA$LKJI$QNOL$T$WP$`Y^_$`onm$dcba$lkji$mjkh$tsrq$tuJK$xgfe$|
API String ID: 2994545307-1418943773
Opcode ID: 5e8d2be1818af5a1a2e884eca125e0d37b42268814bbe167572c7fb680074e95
Instruction ID: b8a6fb430eb92134d8c8e3c40b57b4369f8ade4823c6545c40d8d5822f1cc625
Opcode Fuzzy Hash: 5e8d2be1818af5a1a2e884eca125e0d37b42268814bbe167572c7fb680074e95
Instruction Fuzzy Hash: 36F28BB05093829BD774CF14C484BABBBE6FFD5305F1448ACE8D98B251DB359988CB52

Function 00B723E0 Relevance: 31.3, APIs: 4, Strings: 12, Instructions: 3298COMMON

Download Yara Rule

Strings

ggxz, xrefs: 00B72685
3<, xrefs: 00B732D6
|}&C, xrefs: 00B72F21
%*+(, xrefs: 00B740EF
:, xrefs: 00B732DD
f@~!, xrefs: 00B725FF
{l`~, xrefs: 00B7268C
aenQ, xrefs: 00B7276A
fedc, xrefs: 00B72782
mlc@, xrefs: 00B7275C
`tii, xrefs: 00B72693
Cx, xrefs: 00B7453D

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID: %*+($3<$:$Cx$`tii$aenQ$f@~!$fedc$ggxz$mlc@${l`~$|}&C
API String ID: 0-786070067
Opcode ID: 8ac25b9ab4b84aab29b00661a70de73863789a62daede501776deee24b36b074
Instruction ID: f91bffbf463c084ef4f4bc7f3d93669f7ff2bb44c439d78369f6b43fa9b249fb
Opcode Fuzzy Hash: 8ac25b9ab4b84aab29b00661a70de73863789a62daede501776deee24b36b074
Instruction Fuzzy Hash: AF33AC70504B818FD7258F38C590B62BBE1FF16304F58899DD4EA9BB92C735E906CBA1

Function 00B69F62 Relevance: 21.7, Strings: 17, Instructions: 473COMMON

Download Yara Rule

Strings

Gt, xrefs: 00B69FF8
=], xrefs: 00B6A36A
/), xrefs: 00B6A66D
N[, xrefs: 00B6A375
]{, xrefs: 00B6A1E7, 00B6A1F3
_Y, xrefs: 00B6A641
WH, xrefs: 00B6AA1C
WQ, xrefs: 00B6A62B
(a*c, xrefs: 00B6A147
%e6g, xrefs: 00B6A152
CG, xrefs: 00B6AA32
S], xrefs: 00B6A636
JG, xrefs: 00B6AA27
?m,o, xrefs: 00B6A13C
sm, xrefs: 00B6A830
kW, xrefs: 00B6A380
hi, xrefs: 00B6AB9D

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID: %e6g$(a*c$=]$?m,o$CG$Gt$JG$N[$WH$]{$hi$kW$/)$S]$WQ$_Y$sm
API String ID: 0-1131134755
Opcode ID: bbcf6a9f4c4e021b2ade66b2cf8f07f4d6e39b1e6793f3f36e85ef461a4a304f
Instruction ID: 7260e893f51026c2b544c687ed782f15e22e42cd173d40e9f3ffe57ffeb0182b
Opcode Fuzzy Hash: bbcf6a9f4c4e021b2ade66b2cf8f07f4d6e39b1e6793f3f36e85ef461a4a304f
Instruction Fuzzy Hash: C352B6B404D3858AE270CF25D681B9EBAF1BB92740F608E1DE1EDAB255DB748045CF93

Function 00B69510 Relevance: 20.4, Strings: 16, Instructions: 427COMMON

Download Yara Rule

Strings

T#a-, xrefs: 00B69AE3
G+X5, xrefs: 00B69AF3
;IJK, xrefs: 00B6983E
,A&C, xrefs: 00B6982E
z=Q?, xrefs: 00B69826
8;, xrefs: 00B69B13
2A"_, xrefs: 00B69980
L3Y=, xrefs: 00B69B03
pq, xrefs: 00B699E0
O+f), xrefs: 00B69634, 00B6963D
B?Q9, xrefs: 00B69B0B
?M0K, xrefs: 00B69968
!E4G, xrefs: 00B69836
B7U1, xrefs: 00B69AFB
G'M!, xrefs: 00B69ADB
X/R), xrefs: 00B69AEB

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID: !E4G$,A&C$2A"_$8;$;IJK$?M0K$B7U1$B?Q9$G'M!$G+X5$L3Y=$O+f)$T#a-$X/R)$pq$z=Q?
API String ID: 0-655414846
Opcode ID: a60712e35d5ceefbf257ef8c73695e77d733daaf6d75becf3c52346ccab0548b
Instruction ID: 93d060df843d00af5fdc0281b51ca1454ad781dd82f6cfe5355a8221ce40ed04
Opcode Fuzzy Hash: a60712e35d5ceefbf257ef8c73695e77d733daaf6d75becf3c52346ccab0548b
Instruction Fuzzy Hash: DFF140B4518380ABD310DF15D981A2BBBF8FB96B48F044D5CF5D99B252D338DA08CB96

Function 00D09810 Relevance: 15.4, Strings: 11, Instructions: 1648COMMON

Download Yara Rule

Strings

$9Y?, xrefs: 00D09E83
gW?W, xrefs: 00D0A39F
]./z, xrefs: 00D0A483
mlf, xrefs: 00D098F1
2vo, xrefs: 00D09FCB
s?{, xrefs: 00D098AF
;0`, xrefs: 00D0A0B0
.oM, xrefs: 00D0A460
{s, xrefs: 00D0AB2F
cD}{, xrefs: 00D0A0A1
R[$s, xrefs: 00D0992D

Memory Dump Source

Source File: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID: $9Y?$2vo$;0`$R[$s$]./z$cD}{$gW?W$mlf$s?{$.oM${s
API String ID: 0-1227902733
Opcode ID: 780bd4ce0c49d305dd34c94bbfa0d4fbc14b6ea292c9d8b27affbaa374d3cd63
Instruction ID: b68719153d3edddfc28692f0c259553a77f9188f0c22cf66962661ebcba33859
Opcode Fuzzy Hash: 780bd4ce0c49d305dd34c94bbfa0d4fbc14b6ea292c9d8b27affbaa374d3cd63
Instruction Fuzzy Hash: 3DB228F360C2049FE704AE29EC8567AFBE6EFD4320F16893DE6C4C3744EA7598058656

Function 00B6DD29 Relevance: 14.9, Strings: 11, Instructions: 1142COMMON

Download Yara Rule

Strings

Y9N;, xrefs: 00B6E245
{E, xrefs: 00B6E323
hX]N, xrefs: 00B6DDC7
%*+(, xrefs: 00B6E143
<Y.[, xrefs: 00B6E27D
)IgK, xrefs: 00B6E261
n\+H, xrefs: 00B6DDC0
,Q?S, xrefs: 00B6E26F
=]+_, xrefs: 00B6E276
upH}, xrefs: 00B6DE8A, 00B6E798, 00B6DF4A
-M2O, xrefs: 00B6E25A

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID: %*+($)IgK$,Q?S$-M2O$<Y.[$=]+_$Y9N;$hX]N$n\+H$upH}${E
API String ID: 0-1557708024
Opcode ID: b0942f2e0ba66e79ced8c838b3d127ce66af1fa522dc8a9d399ae215c2eb5329
Instruction ID: 8f2978a876b20c3809955a512697adaaa3ef61c6264ea0065b3ec6ca2f177295
Opcode Fuzzy Hash: b0942f2e0ba66e79ced8c838b3d127ce66af1fa522dc8a9d399ae215c2eb5329
Instruction Fuzzy Hash: 7D92D175E00205CFDB14CFA8D8916AEBBF2FF49310F2985A9E456AB391D735AD01CB90

Function 00D07C1B Relevance: 12.9, Strings: 9, Instructions: 1618COMMON

Download Yara Rule

Strings

({, xrefs: 00D07D76
e&}, xrefs: 00D0818B
qe?, xrefs: 00D07CDE
5d#, xrefs: 00D07D07
lu_, xrefs: 00D081B5
cS?, xrefs: 00D08325
qp?, xrefs: 00D08587
gS?, xrefs: 00D0832A
WW__, xrefs: 00D088C5

Memory Dump Source

Source File: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID: ({$5d#$WW__$cS?$e&}$gS?$qp?$qe?$lu_
API String ID: 0-2817165629
Opcode ID: 1f2e1e6615c523fdfd8e40fff0745fa692a8a7510717fa0cef4ad685d6184f85
Instruction ID: fae07b20fe7fe148869b40aee60e95147cbe5cb4fe8cbd77f5ad64f68697bebc
Opcode Fuzzy Hash: 1f2e1e6615c523fdfd8e40fff0745fa692a8a7510717fa0cef4ad685d6184f85
Instruction Fuzzy Hash: 2EB23AF3A0C2049FE3046E2DEC4567ABBE9EF94720F1A893DEAC4C7344E63559058697

Function 00B6098B Relevance: 10.8, Strings: 8, Instructions: 836COMMON

Download Yara Rule

Strings

{, xrefs: 00B61502
,#15, xrefs: 00B60F94
qrqp, xrefs: 00B61089
cah`, xrefs: 00B6107E
9.5^, xrefs: 00B60F9F
gce/, xrefs: 00B61073
&> &, xrefs: 00B60F89
%*+(, xrefs: 00B60A77, 00B60A86

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID: %*+($&> &$,#15$9.5^$cah`$gce/$qrqp${
API String ID: 0-4102007303
Opcode ID: ae74d8d325882d231b178bde8134a8cba5f35707e53ad14cbfbcd83ed443496d
Instruction ID: 20f3542a54698c6e0dd85e99cb7323682933ef38aa4a8ea52ac7604e34ed177d
Opcode Fuzzy Hash: ae74d8d325882d231b178bde8134a8cba5f35707e53ad14cbfbcd83ed443496d
Instruction Fuzzy Hash: C46287B16183818BD730DF18D891BABBBE1FF96314F084D6DE49A8B641E7798940CB53

Function 00B41000 Relevance: 10.5, Strings: 7, Instructions: 1785COMMON

Download Yara Rule

Strings

-, xrefs: 00B421ED
0123456789abcdefxp, xrefs: 00B41587, 00B415F8
gfff, xrefs: 00B42226
gfff, xrefs: 00B42297
gfff, xrefs: 00B422E1
@, xrefs: 00B42C40
0123456789ABCDEFXP, xrefs: 00B4157D, 00B415EB

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID: -$0123456789ABCDEFXP$0123456789abcdefxp$@$gfff$gfff$gfff
API String ID: 0-2517803157
Opcode ID: 6ef8cf448af306264a457a89024c49c0ed1dd123e9f94083d2ae012a83d486de
Instruction ID: 304e56fc07c550b2d2c6e8ea6d0d6146e41b6dd3ad3ac83300da8149a0006fe1
Opcode Fuzzy Hash: 6ef8cf448af306264a457a89024c49c0ed1dd123e9f94083d2ae012a83d486de
Instruction Fuzzy Hash: CBD2F171A083518FD718CF28C49036ABBE2EFD5314F188AADF49987391D774DA45EB82

Function 00D0CDF2 Relevance: 10.4, Strings: 7, Instructions: 1626COMMON

Download Yara Rule

Strings

NKzy, xrefs: 00D0D020
%@, xrefs: 00D0E0FE
7, xrefs: 00D0E051
&:m6, xrefs: 00D0D61E
)M?, xrefs: 00D0DEA7
:@Uo, xrefs: 00D0D9F0
+}g, xrefs: 00D0DB4B

Memory Dump Source

Source File: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID: %@$&:m6$+}g$:@Uo$NKzy$)M?$7
API String ID: 0-3240409788
Opcode ID: ce2790f0fd6e83cbbf2c1915e95a5f9bc7b240469de32f9b2eb795ab4ff3d2cf
Instruction ID: 52b475d161d769f8da783c58f1bf3886294e95a660bc6c1fe5f5b3197726e612
Opcode Fuzzy Hash: ce2790f0fd6e83cbbf2c1915e95a5f9bc7b240469de32f9b2eb795ab4ff3d2cf
Instruction Fuzzy Hash: BAB2C3F3A082009FD304AE2DDC8567AFBE6EF94720F1A893DE6C4C7744E63598458697

Function 00D02BC7 Relevance: 7.8, Strings: 5, Instructions: 1591COMMON

Download Yara Rule

Strings

h, xrefs: 00D03AD3
g}/, xrefs: 00D03B87
]mz, xrefs: 00D03F0D
;_>3, xrefs: 00D02F0E
5"J{, xrefs: 00D0384F

Memory Dump Source

Source File: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID: 5"J{$;_>3$h$]mz$g}/
API String ID: 0-3149574040
Opcode ID: 06b27b78ea4ff85bc103f4414f53202e4c76db49bf027dc3bae45430d822cdb4
Instruction ID: 002cb36e1a529792cc63b1fa6d6864a167c134007cce59dd5e211c089329b3f9
Opcode Fuzzy Hash: 06b27b78ea4ff85bc103f4414f53202e4c76db49bf027dc3bae45430d822cdb4
Instruction Fuzzy Hash: 30B2E6F3A086049FE304AE2DDC4567AB7E5EFD4320F1A893DEAC4C7744EA3558058697

Function 00B412F7 Relevance: 7.2, Strings: 5, Instructions: 922COMMON

Download Yara Rule

Strings

@, xrefs: 00B43531
0, xrefs: 00B41DC1
0, xrefs: 00B41E88
0, xrefs: 00B4243E
i, xrefs: 00B428EA

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID: 0$0$0$@$i
API String ID: 0-3124195287
Opcode ID: c3424c36641dc19d79ec22ea1e4b63fcfd8477eb42cef7b75d155c877d6929c0
Instruction ID: 1d925c0d6e99213d4aa9b663b34d0a584a63d3b9b0d56385010d209f98ae9c0c
Opcode Fuzzy Hash: c3424c36641dc19d79ec22ea1e4b63fcfd8477eb42cef7b75d155c877d6929c0
Instruction Fuzzy Hash: EF62C071A0C3818BD318CF28C49076ABBE1EFD5344F588DADE8D987291D774DA49EB42

Function 00B4164F Relevance: 6.7, Strings: 5, Instructions: 472COMMON

Download Yara Rule

Strings

gfff, xrefs: 00B41F3C
+, xrefs: 00B41573
0123456789abcdefxp, xrefs: 00B41659
gfff, xrefs: 00B41F57
0123456789ABCDEFXP, xrefs: 00B4164F

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID: +$0123456789ABCDEFXP$0123456789abcdefxp$gfff$gfff
API String ID: 0-1123320326
Opcode ID: 6575c8fc4c7e8c6a2a8bbb4958cfdf78e74724dc7d1f86e2b282e7289c27bc13
Instruction ID: d898ccd937ece2cfe4cab63a963bee76c9e73bcc6d24caaa9121e2c7fc3af67f
Opcode Fuzzy Hash: 6575c8fc4c7e8c6a2a8bbb4958cfdf78e74724dc7d1f86e2b282e7289c27bc13
Instruction Fuzzy Hash: 04F1A13160C3918FC715CF28C48426AFBE2AFD9304F588AADE4D987356D734DA45EB92

Function 00B413A3 Relevance: 6.6, Strings: 5, Instructions: 390COMMON

Download Yara Rule

Strings

gfff, xrefs: 00B41F3C
0123456789abcdefxp, xrefs: 00B413AD
gfff, xrefs: 00B41F57
-, xrefs: 00B41F23
0123456789ABCDEFXP, xrefs: 00B413A3

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID: -$0123456789ABCDEFXP$0123456789abcdefxp$gfff$gfff
API String ID: 0-3620105454
Opcode ID: 959423e0188baf2ceed4346efc84a6327c7899ae9ccc488b1174ed8210b7f1b5
Instruction ID: 266ab53fc4c1f5db9ff8e9a9bfdc973f3941c81becd60ab4f7547157d75796cd
Opcode Fuzzy Hash: 959423e0188baf2ceed4346efc84a6327c7899ae9ccc488b1174ed8210b7f1b5
Instruction Fuzzy Hash: 82D18D3160C7818FC719CF29C48426AFBE2AFD9304F48CAADE4D987356D634DA49DB52

Function 00D0B2FD Relevance: 6.6, Strings: 4, Instructions: 1622COMMON

Download Yara Rule

Strings

QoHh, xrefs: 00D0C015
UO@N, xrefs: 00D0C0B9
j?, xrefs: 00D0C660
iN0a, xrefs: 00D0BA2B

Memory Dump Source

Source File: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID: QoHh$UO@N$iN0a$j?
API String ID: 0-1263174943
Opcode ID: ffc63dc08b5e27dc8e4d61c13a032f13c85633089a0ed6da967c6fdfb2006fc0
Instruction ID: d86666cb280cde3706eebc9c07039eb98210d7cc7941c37dc119eb907d89c467
Opcode Fuzzy Hash: ffc63dc08b5e27dc8e4d61c13a032f13c85633089a0ed6da967c6fdfb2006fc0
Instruction Fuzzy Hash: 2FB229F3A0C204AFE304AE2DDC8567AFBE9EF94760F16453DE6C4C7744EA3598018696

Function 00D0118F Relevance: 6.6, Strings: 4, Instructions: 1584COMMON

Download Yara Rule

Strings

RSoz, xrefs: 00D01222
%5`v, xrefs: 00D0141A
w4?, xrefs: 00D0228A
`WW, xrefs: 00D02473

Memory Dump Source

Source File: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID: %5`v$RSoz$`WW$w4?
API String ID: 0-4174836361
Opcode ID: 209b4bf7e28aa0ac45f4da539e3affecf38a6cc646ce54b08a8fd1c48b1b33cd
Instruction ID: 20a455ba45a4fad4fa4d63f7a7bc69b4102b83a826b5dc9d31c39611e32c3244
Opcode Fuzzy Hash: 209b4bf7e28aa0ac45f4da539e3affecf38a6cc646ce54b08a8fd1c48b1b33cd
Instruction Fuzzy Hash: A9B216F360C200AFE7046E29EC8567ABBE9EFD4720F1A893DE6C4C3744E63558458697

Function 00B6FD10 Relevance: 5.7, Strings: 4, Instructions: 667COMMON

Download Yara Rule

Strings

NA_I, xrefs: 00B7036D
m1s3, xrefs: 00B6FEC3, 00B6FECB
uvw, xrefs: 00B6FE95
:, xrefs: 00B70087

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID: :$NA_I$m1s3$uvw
API String ID: 0-3973114637
Opcode ID: 86065e7c73d11eb80e3517f30295eaaa2b8a137e14201a7d235fbad8203411d6
Instruction ID: 5e4dbda527c29df38a838f41c2b66965bf1e934856bf83105cd4de4a326cb8d7
Opcode Fuzzy Hash: 86065e7c73d11eb80e3517f30295eaaa2b8a137e14201a7d235fbad8203411d6
Instruction Fuzzy Hash: BE32ACB151C381DFD311EF28D880A2ABBE1EB89350F148D9DF5E98B2A2D735D905CB52

Function 00B53BE2 Relevance: 5.4, Strings: 4, Instructions: 431COMMON

Download Yara Rule

Strings

p, xrefs: 00B53C80
%*+(, xrefs: 00B53EC4
ss, xrefs: 00B53C79
;z, xrefs: 00B53C87

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID: %*+($;z$p$ss
API String ID: 0-2391135358
Opcode ID: 0f093f38a0403904e848d93c56e0d26f8cc26305746a2198bcd6dabcd8c7e192
Instruction ID: 22a73af545ba1e9b1b3c30686ef8575e0e4030991155000a1ce702b7d05ffdf2
Opcode Fuzzy Hash: 0f093f38a0403904e848d93c56e0d26f8cc26305746a2198bcd6dabcd8c7e192
Instruction Fuzzy Hash: 7A025BB4810B009FD760EF24D986756BFF4FB01701F50899DE89A9B695E730E819CFA2

Function 00CFC168 Relevance: 5.4, Strings: 3, Instructions: 1651COMMON

Download Yara Rule

Strings

e?, xrefs: 00CFCE5F
Co}, xrefs: 00CFCF6B
'|W, xrefs: 00CFCB59

Memory Dump Source

Source File: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID: '|W$Co}$e?
API String ID: 0-3102051264
Opcode ID: 07f37db3092f83452dda44ca2be68576d415e82d17b7061d5de5dd6fa4c06321
Instruction ID: 4884584f6bad503c92a7d17d5bc57c37b9c190c2680d96058738fb4a28b91bd6
Opcode Fuzzy Hash: 07f37db3092f83452dda44ca2be68576d415e82d17b7061d5de5dd6fa4c06321
Instruction Fuzzy Hash: 85B208F3A0C2149FE3046F2DEC85A7ABBE9EF94320F16893DE6C4C7744E63558058696

Function 00B62260 Relevance: 5.4, Strings: 4, Instructions: 383COMMON

Download Yara Rule

Strings

hu, xrefs: 00B6232F
lc, xrefs: 00B62507
sj, xrefs: 00B62327
a|, xrefs: 00B62317

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID: a|$hu$lc$sj
API String ID: 0-3748788050
Opcode ID: ef9da8040ed234502752138cc60fdacb3a30f7be9351b761f52101c9424616bb
Instruction ID: 8e3567029290e0a96140226d996b5d4ed22a349ec02708a4ebc0514260a47615
Opcode Fuzzy Hash: ef9da8040ed234502752138cc60fdacb3a30f7be9351b761f52101c9424616bb
Instruction Fuzzy Hash: 00A1ACB04087418BD720DF18C891A2BB7F0FFA6754F188A4CE8D99B391E739D941CB96

Function 00CFDC44 Relevance: 5.3, Strings: 3, Instructions: 1585COMMON

Download Yara Rule

Strings

[#~>, xrefs: 00CFE0E1
N~g, xrefs: 00CFECAF
B2Be, xrefs: 00CFEF02

Memory Dump Source

Source File: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID: B2Be$N~g$[#~>
API String ID: 0-962043494
Opcode ID: f98b5e84e7ce38d585f83bc8f302f58aef77055a5b623cab487de9be2bea3a43
Instruction ID: c5beae70320d21b930b7a29d38c375ee0bff62da0fa36942dbb6bcc3dd69f3bd
Opcode Fuzzy Hash: f98b5e84e7ce38d585f83bc8f302f58aef77055a5b623cab487de9be2bea3a43
Instruction Fuzzy Hash: 89B2A4F360C200AFE3046E2DEC8567AFBE9EF94720F16493DEAC4C7744E63598458696

Function 00B6D7AF Relevance: 5.2, Strings: 4, Instructions: 213COMMON

Download Yara Rule

Strings

CV, xrefs: 00B6D98B
T>, xrefs: 00B6D984
KV, xrefs: 00B6D97D
#', xrefs: 00B6D9EA

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID: #'$CV$KV$T>
API String ID: 0-95592268
Opcode ID: 5232a6572b622bab012e522ccb3af0c1e1c708427207e3fce767d98e78f09967
Instruction ID: 1d1dc508c7360dd510f2b5d422b5e3cf21184070906ed5d5ad3aff031f4f55ee
Opcode Fuzzy Hash: 5232a6572b622bab012e522ccb3af0c1e1c708427207e3fce767d98e78f09967
Instruction Fuzzy Hash: 868165B48017459BCB20DFA6D68516EBFF1FF16300F604A4CE486ABA55C334AA55CFE2

Function 00B6AC91 Relevance: 5.1, Strings: 4, Instructions: 128COMMON

Download Yara Rule

Strings

lk, xrefs: 00B6ACBC
,{*y, xrefs: 00B6AD07, 00B6AD13
4c2a, xrefs: 00B6ACA9
(g6e, xrefs: 00B6ACA1

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID: (g6e$,{*y$4c2a$lk
API String ID: 0-1327526056
Opcode ID: 8a464fadaa0e5e81b3a8a67b32f3bba27cae3e1d95b59e90dcdc39782bf10760
Instruction ID: 6485907fb4a870bfec023b1d690845e23870b953c5a106d480afc235e98a524c
Opcode Fuzzy Hash: 8a464fadaa0e5e81b3a8a67b32f3bba27cae3e1d95b59e90dcdc39782bf10760
Instruction Fuzzy Hash: BC417774408382CBD7209F24D900BABB7F4FF86345F5459ADE5C8A7260DB36D944CB96

Function 00735FD0 Relevance: 4.5, Strings: 3, Instructions: 790COMMON

Download Yara Rule

Strings

q, xrefs: 007361D1
q, xrefs: 00736651
q, xrefs: 00736200

Memory Dump Source

Source File: 00000000.00000003.1766910824.0000000000731000.00000004.00000020.00020000.00000000.sdmp, Offset: 00731000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_731000_file.jbxd

Similarity

API ID:
String ID: q$q$q
API String ID: 0-2920916064
Opcode ID: 97c5d45d11cd7a3f985cca1e78dce2f3cfda04578f3747edbd74b5191e295eca
Instruction ID: 0e55e402a55a4679cca1f653232cf365b3cccb28f52f11c53080fff9d8f48f82
Opcode Fuzzy Hash: 97c5d45d11cd7a3f985cca1e78dce2f3cfda04578f3747edbd74b5191e295eca
Instruction Fuzzy Hash: 8572546580E3D16FE7078B349865291BF706E23218B1E86DBC4C1CF4B3E25D494AD7A7

Function 00B6C470 Relevance: 4.2, Strings: 3, Instructions: 419COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00B6C8C3, 00B6C8CB
%*+(, xrefs: 00B6C9E4, 00B6C9ED
~/i!, xrefs: 00B6C537

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID: %*+($%*+($~/i!
API String ID: 0-4033100838
Opcode ID: b02788fa8e11578d61c9600394481a75719ba43830490b70567a703cecc8745c
Instruction ID: ac092d497f156d27e9fa30088f7261dfdfe5ecca279e060811c1ef798ff98c00
Opcode Fuzzy Hash: b02788fa8e11578d61c9600394481a75719ba43830490b70567a703cecc8745c
Instruction Fuzzy Hash: 1BE1A8B1919340DFE3209F68D881B2ABBF5FB85344F488C6DE5C987261DB35D810CBA2

Function 00CFF734 Relevance: 4.1, Strings: 2, Instructions: 1589COMMON

Download Yara Rule

Strings

sMcs, xrefs: 00D001D3
xH~6, xrefs: 00CFFC81

Memory Dump Source

Source File: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID: sMcs$xH~6
API String ID: 0-806488507
Opcode ID: 8e0f74d0cee482b0219fc0872a1f4c6f61e96bce0769cd377788dc7da743d056
Instruction ID: 4d0aec45a832315afe8043b58202043bab09e753c1556bcbb379662e10245c68
Opcode Fuzzy Hash: 8e0f74d0cee482b0219fc0872a1f4c6f61e96bce0769cd377788dc7da743d056
Instruction Fuzzy Hash: 5FB2E7F360C6049FE3046F29EC8567ABBE9EF94320F164A3DEAC4C7744EA3558458693

Function 00D06232 Relevance: 4.1, Strings: 2, Instructions: 1564COMMON

Download Yara Rule

Strings

n>, xrefs: 00D065A3
wf^}, xrefs: 00D067EB

Memory Dump Source

Source File: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID: n>$wf^}
API String ID: 0-1475527695
Opcode ID: 192d8d3262b164c34252ce174efb0bdd2ca5a252c2b0268ca9f0c5a90a98f187
Instruction ID: ce65fabbd3b118a8dfc16a62428e0dc73e5eb2082e24c1242d0e917aecc31e3d
Opcode Fuzzy Hash: 192d8d3262b164c34252ce174efb0bdd2ca5a252c2b0268ca9f0c5a90a98f187
Instruction Fuzzy Hash: F2B205B360C6049FE304AF29EC8567AFBE9EF94320F16893DE6C5C7744EA3558018697

Function 00B84040 Relevance: 3.1, Strings: 2, Instructions: 577COMMON

Download Yara Rule

Strings

f, xrefs: 00B8420C
%*+(, xrefs: 00B840A4, 00B840AD

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID: %*+($f
API String ID: 0-2038831151
Opcode ID: cb57b6efeafc2cc075a50e9bade73a654402b26f564c468538dffb29cdec4643
Instruction ID: 62b8cbbad613af5036b7d8b9ebcc3533df66c1ffa316d2a49e07ec86725fef04
Opcode Fuzzy Hash: cb57b6efeafc2cc075a50e9bade73a654402b26f564c468538dffb29cdec4643
Instruction Fuzzy Hash: 4312AE715083429FC715EF18C880B2EBBE2FB89314F588AADF494973A1D735D945CB92

Function 00B7F620 Relevance: 3.0, Strings: 2, Instructions: 461COMMON

Download Yara Rule

Strings

hi, xrefs: 00B7F6E6
dg, xrefs: 00B7F7F5

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID: dg$hi
API String ID: 0-2859417413
Opcode ID: e3ecaf0e7b985cca4d6f609ecb0ceada0a81109e41e6b61452073b81dc070b1a
Instruction ID: f83c33a559b355d1912745de48cf7eb14c4b40bea180c062d21022f991d53ff7
Opcode Fuzzy Hash: e3ecaf0e7b985cca4d6f609ecb0ceada0a81109e41e6b61452073b81dc070b1a
Instruction Fuzzy Hash: BFF19471618302EFE304CF24C891B6ABBF6FB86344F1489ADF1998B2A1C735D945CB56

Function 00B435B0 Relevance: 2.9, Strings: 2, Instructions: 411COMMON

Download Yara Rule

Strings

NaN, xrefs: 00B4360E
Inf, xrefs: 00B43607

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID: Inf$NaN
API String ID: 0-3500518849
Opcode ID: ac709dce10761502fe1fecceb381aed97c51165f51ef4f2a4dde4dd25a9f7b91
Instruction ID: 35d20875dc2191091ce3d3d2763b5da734db5cd1f28e94e8d7c208ce33616328
Opcode Fuzzy Hash: ac709dce10761502fe1fecceb381aed97c51165f51ef4f2a4dde4dd25a9f7b91
Instruction Fuzzy Hash: 6FD1D671A183119BC704CF28C88061EFBE1EBC8B50F19896DF9D9973A1E775DE059B82

Function 00B5FFDF Relevance: 2.7, Strings: 2, Instructions: 185COMMON

Download Yara Rule

Strings

Ye[g, xrefs: 00B600F6
BaBc, xrefs: 00B60197

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID: BaBc$Ye[g
API String ID: 0-286865133
Opcode ID: a3979741394603c07eadf231dc50faa5016d6e2acd4ce8b556f54eb159208edb
Instruction ID: 4a0b164f9218242c92fe371210b6fe600361b2410a092b656c1727736a5204f8
Opcode Fuzzy Hash: a3979741394603c07eadf231dc50faa5016d6e2acd4ce8b556f54eb159208edb
Instruction Fuzzy Hash: FC51ECB16193858BC731EF15C881BABB7E0FF96310F08499DE4DA8B651E3789940CB57

Function 00B45160 Relevance: 1.8, Strings: 1, Instructions: 577COMMON

Download Yara Rule

Strings

%1.17g, xrefs: 00B454C8

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID: %1.17g
API String ID: 0-1551345525
Opcode ID: 7f07a78b086d2b7c0a2fc3a749794cc671fd53e915494de42282e1354e8add2a
Instruction ID: af7f63756d880bfab9bd86098b9703ebc7fcaadad93f4bc741fc00d85dee8b5d
Opcode Fuzzy Hash: 7f07a78b086d2b7c0a2fc3a749794cc671fd53e915494de42282e1354e8add2a
Instruction Fuzzy Hash: 5B22D5B6608F418BE7358E18D480326BBE2EFE1304F1985ADD8994B343E771DE44E741

Function 00B712D0 Relevance: 1.7, Strings: 1, Instructions: 484COMMON

Download Yara Rule

Strings

", xrefs: 00B715D1

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 1e36e4a90a5bcd9904d9a2755a98640d2f51fe7f53356f7c076c40d918f289ea
Instruction ID: 1986f4f01e3756c3bf65c37ef51367251543004eefc7fc38d05e64458faf8d15
Opcode Fuzzy Hash: 1e36e4a90a5bcd9904d9a2755a98640d2f51fe7f53356f7c076c40d918f289ea
Instruction Fuzzy Hash: 1EF10671A083415BC728CE2CC49166BBBE5EFC5354F18CDADE8AE97382D634DD0587A2

Function 00B6AE57 Relevance: 1.7, Strings: 1, Instructions: 455COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00B6B2D3, 00B6B2DB

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: af6f9b14384fed8f46cdef6cab7810771fe807d7ead3dfdf328f369022cab7a9
Instruction ID: 26c6e05638d13821e604ed055dd4ae0520d92258a5d64033200d177117017237
Opcode Fuzzy Hash: af6f9b14384fed8f46cdef6cab7810771fe807d7ead3dfdf328f369022cab7a9
Instruction Fuzzy Hash: F9E1C971508306CBC724DF28C89096EB7F2FF98781F54895CE4C597220E739EA99DB82

Function 00B56EBF Relevance: 1.7, Strings: 1, Instructions: 447COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00B56EF3

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 74899c92d8267b3ca2ad14be37cc05485c428bf8d746c4091c5e1e0763094860
Instruction ID: 5b6998d2309d51bb6b967ddd7112b23054a1736738c05ac7cbe07aeacaec32d2
Opcode Fuzzy Hash: 74899c92d8267b3ca2ad14be37cc05485c428bf8d746c4091c5e1e0763094860
Instruction Fuzzy Hash: 69F19EB5A00701CFC724DF24D881A26B7F2FF58315B548AADE897876A1EB31F919CB41

Function 00B67E60 Relevance: 1.7, Strings: 1, Instructions: 425COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00B68263, 00B6826B

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 20e90b3276b06a09e4c7b5b0df214544f5f2f8d8cb41dc9e9d099474b24a4a44
Instruction ID: b408ab73c7a42d646079111cde7fb20c1cdcefb109a473b2cda480732d19e69e
Opcode Fuzzy Hash: 20e90b3276b06a09e4c7b5b0df214544f5f2f8d8cb41dc9e9d099474b24a4a44
Instruction Fuzzy Hash: 2AC1DFB1508200ABD710EF14D882A2BB7F5EF96754F088998F8C59B251EB39DD05CBA2

Function 00B68D62 Relevance: 1.7, Strings: 1, Instructions: 410COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00B69233, 00B6923B

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 31a56ed0f3f076f386881df9945a69ecd05934c9c5729a1276c0697cb9f5da2f
Instruction ID: cf0a07b988c02cae8d8a13a7a3b0abaf12b651002458561150c6ba63be07c8dd
Opcode Fuzzy Hash: 31a56ed0f3f076f386881df9945a69ecd05934c9c5729a1276c0697cb9f5da2f
Instruction Fuzzy Hash: AED1C171618302DFD704EF64DC9062AB7E5FF89304F4949BDE886872A1DB35E950CB51

Function 00B87FC0 Relevance: 1.6, Strings: 1, Instructions: 387COMMON

Download Yara Rule

Strings

P, xrefs: 00B88167

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID: P
API String ID: 0-3110715001
Opcode ID: 9d492dc5e59da729dc41b61c018f71423b43d2ed72b229c625436686a5ec31e4
Instruction ID: 3ba309a035b5587802945af5b4b31dea285eeb8d34e77f716fa9202e2fb4aad4
Opcode Fuzzy Hash: 9d492dc5e59da729dc41b61c018f71423b43d2ed72b229c625436686a5ec31e4
Instruction Fuzzy Hash: BCD105729082658FC725DE18D89071FB7E1EB84718F59866DE8B5AB3A0CB71DC06C7C1

Function 00B6CCD0 Relevance: 1.6, Strings: 1, Instructions: 357COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00B6CDC3, 00B6CDCB

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID: InitializeThunk
String ID: %*+(
API String ID: 2994545307-3233224373
Opcode ID: b63e2abdee3501ab61c782eec8fa85d4fdf076bf9943f17c3a912b73267e9f88
Instruction ID: 69dfa413ac5e1f7b4615235e955dcdc273cb64d3b1901536d7306632d1f051c3
Opcode Fuzzy Hash: b63e2abdee3501ab61c782eec8fa85d4fdf076bf9943f17c3a912b73267e9f88
Instruction Fuzzy Hash: D8B11070A093418BD714DF58D890B3BBBF2EF85340F1448ACE5C58B251E73AE954CBA2

Function 00B7FC20 Relevance: 1.5, Strings: 1, Instructions: 265COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00B7FCA4, 00B7FCAD

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 2f9c6304800d02ca114c42ba18b71a4092e55da71072eaf91ba3e7f7efcba8b5
Instruction ID: 1689375de350981616712c0ae1991ce7c942acb0915aa1a62cd29f3cccb3b2db
Opcode Fuzzy Hash: 2f9c6304800d02ca114c42ba18b71a4092e55da71072eaf91ba3e7f7efcba8b5
Instruction Fuzzy Hash: 6781FF71508302EFD321EFA8D984B2AB7E5FB99B01F04886CF1C997291DB30D914CB62

Function 00B5D457 Relevance: 1.5, Strings: 1, Instructions: 248COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00B5D663, 00B5D66B

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: aded7d521622d9aab63f16162276b02909303bd83d4986c6e80627b75b53b9c6
Instruction ID: 061ec39b2688143b2ea0d6cf31923e3247ebb59bebfee046efd90e74277fbd9e
Opcode Fuzzy Hash: aded7d521622d9aab63f16162276b02909303bd83d4986c6e80627b75b53b9c6
Instruction Fuzzy Hash: 4061E372905214DBD720EF58EC82B3A73F0FFA4355F080AA9F98597261E731D915C792

Function 00B84A40 Relevance: 1.5, Strings: 1, Instructions: 220COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00B84C33, 00B84C3B

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: ea9af38bf91d6b98296a64add08223bf10ce0982c4e16ceb366bdb20a3ead521
Instruction ID: f1b1cd601f2b0ec3dcfe9b595ec13721ef56550f459f88fbeff4443998fa8cea
Opcode Fuzzy Hash: ea9af38bf91d6b98296a64add08223bf10ce0982c4e16ceb366bdb20a3ead521
Instruction Fuzzy Hash: 7861E0716083429FD725EF65D880B2AB7EAEBC4314F18899DE9C58B2B1D771EC40CB52

Function 00C414CA Relevance: 1.4, Strings: 1, Instructions: 190COMMON

Download Yara Rule

Strings

7}Bn, xrefs: 00C415EF

Memory Dump Source

Source File: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID: 7}Bn
API String ID: 0-2027193823
Opcode ID: be723c5878889c88b1913002f667ca3e45e6d08a86896335d6a34a65128d9e0c
Instruction ID: 8083b79be974c5dd7d621cf71920ed639e221a078c64bb8bcfa564a4a593c70e
Opcode Fuzzy Hash: be723c5878889c88b1913002f667ca3e45e6d08a86896335d6a34a65128d9e0c
Instruction Fuzzy Hash: 715148F3E081105BF308A92DDC4977AB6DACBD0360F2B823DDA8997784EC795D0582D2

Function 00B4E1A0 Relevance: 1.4, Strings: 1, Instructions: 175COMMON

Download Yara Rule

Strings

000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F8081, xrefs: 00B4E333

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID: 000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F8081
API String ID: 0-2471034898
Opcode ID: 3c6344d6b6815c03f9d52c0607a38d0cf9de330f15527457a48b5a026f32e51a
Instruction ID: cb17584cba4709f501e1bafb9b91c1589796f21eff13f636c1f71854de4c49e4
Opcode Fuzzy Hash: 3c6344d6b6815c03f9d52c0607a38d0cf9de330f15527457a48b5a026f32e51a
Instruction Fuzzy Hash: 5E512733A596904BD329893C5C952A96AC72BA2334B3DC7AAE9F18B3F1D555CD00A390

Function 00B83920 Relevance: 1.4, Strings: 1, Instructions: 172COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00B839E3, 00B839EB

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 3809e28112dfc31983344ebcb5e9f7182d57cc407a1941fd8d9bec45e39fa7ba
Instruction ID: 013947992bb4c2f24ab83c3b8f5205e8f60ee84cb34d2b11effcf3d562140d86
Opcode Fuzzy Hash: 3809e28112dfc31983344ebcb5e9f7182d57cc407a1941fd8d9bec45e39fa7ba
Instruction Fuzzy Hash: E751AF34609200DBCB28EF55D980A2EBBE5FF85F44F18889CE4C697261D776DE10CB62

Function 00B51BEE Relevance: 1.4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

Strings

L3, xrefs: 00B51C3E

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID: L3
API String ID: 0-2730849248
Opcode ID: 8211659a289f42cc237a3c87cb5c51bc9abbdab31c567949fb1d6bffa86d08b3
Instruction ID: 56571c1def8792a9819b03ef4c6487f58e1d26cafe17a5b4215717756a5c53d9
Opcode Fuzzy Hash: 8211659a289f42cc237a3c87cb5c51bc9abbdab31c567949fb1d6bffa86d08b3
Instruction Fuzzy Hash: E2413FB40083809BC7149F68D894B2BBBF0EF8A315F048D9CF9C59B291D736C919CB56

Function 00B7FF70 Relevance: 1.4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00B80033, 00B8003B

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: cafe2b182b40939222ac8ebb405e09bf4a3cbd94b9b3534c6827fd49ad5eefe1
Instruction ID: 8642a03f4d02ad6067deffb6b5430530eff6a2c0b29b2199ef97f8c801dbfcf6
Opcode Fuzzy Hash: cafe2b182b40939222ac8ebb405e09bf4a3cbd94b9b3534c6827fd49ad5eefe1
Instruction Fuzzy Hash: 913116B1918309ABD610FA54DC81B3BB7E9EB81784F1448A8F88597272E231DC18C7A3

Function 00B6E40C Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

72?1, xrefs: 00B6E6A2

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID: 72?1
API String ID: 0-1649870076
Opcode ID: e36ebbf6869bb977c5817b9cdf2e0519f5fb642c6d047c1b2fc06f9341422f00
Instruction ID: 4cb2933c6c7163976155c596492c027c42bcce7253705111deeeb46fbc98c6c3
Opcode Fuzzy Hash: e36ebbf6869bb977c5817b9cdf2e0519f5fb642c6d047c1b2fc06f9341422f00
Instruction Fuzzy Hash: 3031C3B5901205CFDB20CF98E98056FBBF5FB06704F1448A9E45AAB201D735EE05DBA1

Function 00B56F91 Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00B5703B

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: ee6aa713d7f25e859410bd2f5de4bf4307de74986ec1155b18c8df8667991e22
Instruction ID: 34f5ec8094f6b8a26394ab1ceba4bea87f7e48eb7e912f261cdc55ff6d20625c
Opcode Fuzzy Hash: ee6aa713d7f25e859410bd2f5de4bf4307de74986ec1155b18c8df8667991e22
Instruction Fuzzy Hash: E7416A71644B04DBD7358F61D994F26B7F2FB09702F18889CE98A9B6A1EB31F804CB10

Function 00B6E66A Relevance: 1.4, Strings: 1, Instructions: 100COMMON

Download Yara Rule

Strings

72?1, xrefs: 00B6E6A2

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID: 72?1
API String ID: 0-1649870076
Opcode ID: 55a4ee48097ee4dbfc50a932c823e141c9b07981c3364af07d28e73aac754a2b
Instruction ID: a9bf7eb467040c4fcb08ec6da83a4924c915b5ac0d2e73384cc0b31f7f5a19ef
Opcode Fuzzy Hash: 55a4ee48097ee4dbfc50a932c823e141c9b07981c3364af07d28e73aac754a2b
Instruction Fuzzy Hash: 0021BFB5901205CFC720CF98D98056FBBF5FB0A700F1448A9E456AB241D735EE01DBA1

Function 00B89CE0 Relevance: 1.3, Strings: 1, Instructions: 87COMMON

Download Yara Rule

Strings

@, xrefs: 00B89D30

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: ce25e669a3266ce3925099f83e918e319381f2730d640498990d10fd90df93ef
Instruction ID: 01e494a0ae1ba78e4d2d294c8b270c1bad9d45347490269daef6566198b3872b
Opcode Fuzzy Hash: ce25e669a3266ce3925099f83e918e319381f2730d640498990d10fd90df93ef
Instruction Fuzzy Hash: 273176709093009BD720EF14D980A2AFBF9EF9A314F18896DE5C997261D335D904CBAA

Function 00B54E2A Relevance: 1.0, Instructions: 957COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c3d5bf290546d84736fc9e5604e6678260c08efc8a5dc1c80a1f76177eba069
Instruction ID: e2e8d541d1b69f8521e8ef92995e04e505f511d23496047b65c20151cf38bc56
Opcode Fuzzy Hash: 4c3d5bf290546d84736fc9e5604e6678260c08efc8a5dc1c80a1f76177eba069
Instruction Fuzzy Hash: EA6259B0500B408FD735CF24D890B27BBF5AF5A706F5489ACD89A87A52E731F948CB94

Function 00B4BEB0 Relevance: .9, Instructions: 895COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30cb9a533554be97e06675d3460cdff0be9d55b2c6c1132c24f0b6137cc6b4a7
Instruction ID: 2965de7fac8939d16d726e39bfb03f67a3c83d6dd70935d30c2c2ed4b8433997
Opcode Fuzzy Hash: 30cb9a533554be97e06675d3460cdff0be9d55b2c6c1132c24f0b6137cc6b4a7
Instruction Fuzzy Hash: 97525B31A0A7118BC765DF1CD4802BAF7E1FFC4719F298A6DC9C693280E734A951DB86

Function 00736FC0 Relevance: .7, Instructions: 749COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1766910824.0000000000731000.00000004.00000020.00020000.00000000.sdmp, Offset: 00731000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_731000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad34f284e08938d5cfd99f0090aca172d80ca4c4463521958a95feafe9905c56
Instruction ID: 69030e7645ae1747c4e7d9a532b5f4f03408e93390684688f54e097b4dacf02a
Opcode Fuzzy Hash: ad34f284e08938d5cfd99f0090aca172d80ca4c4463521958a95feafe9905c56
Instruction Fuzzy Hash: B702A8A640E7C54FE71B8B3088652817FB0AF23214F1E86DBD4C4CF4A3E26C495AD722

Function 00B88652 Relevance: .7, Instructions: 710COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30c20fc308457c80fbf2eecd0043e07b2324d4a1367bcb2a02af9b1f7fb50e7e
Instruction ID: 962f9144b95aedc1ce3f5580e806ab624aee41889b3fdca9049b9ee923552cec
Opcode Fuzzy Hash: 30c20fc308457c80fbf2eecd0043e07b2324d4a1367bcb2a02af9b1f7fb50e7e
Instruction Fuzzy Hash: 2A22BD3560C340DFD704EF68E990A2ABBE1FF89315F0989AEE58987361DB35D851CB42

Function 00B886F0 Relevance: .7, Instructions: 681COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74eb3d8f61e77c1c00ed034afc1c960769d0ed794f39c716a741585e94830907
Instruction ID: bda5362f0306110b4fe761865fd889e169ce2199c9387520d38a541186a04d52
Opcode Fuzzy Hash: 74eb3d8f61e77c1c00ed034afc1c960769d0ed794f39c716a741585e94830907
Instruction Fuzzy Hash: 1A229B3560C340DFD704EF68E990A2ABBF1FB8A305F09896EE58987361DB35D851CB42

Function 00B4B3A0 Relevance: .7, Instructions: 670COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 171f271c6fcdf6307c6b0849a4b7f37010ce3c9ca6eaf07c2b0422911263997b
Instruction ID: a0fc1f66cb86da0bd219792fef5328d20448157a2d532d25ad513e8d9107b414
Opcode Fuzzy Hash: 171f271c6fcdf6307c6b0849a4b7f37010ce3c9ca6eaf07c2b0422911263997b
Instruction Fuzzy Hash: 8B52A370908B848FE735CB34C494BA7BBE2EF91314F144CADC6D606A82C779EA85E751

Function 00B471F0 Relevance: .7, Instructions: 657COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf75ea5f5196ccbe39d62a4c28d893cc3371d7b81011d5f57204418d35dddf6f
Instruction ID: fa6e467838f837b3fd5fd22f6ee814947af5745c5b7fdfa9522317580e59fce8
Opcode Fuzzy Hash: cf75ea5f5196ccbe39d62a4c28d893cc3371d7b81011d5f57204418d35dddf6f
Instruction Fuzzy Hash: 2752B03150C3458FCB15CF29C0D06AABBE1FF88314F198AADE8995B352DB74DA49DB81

Function 00B48FD0 Relevance: .6, Instructions: 620COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4170cc387d222cec35d2f77b4ac0cf96c3b30ebd44371f488536a33f604d273
Instruction ID: f364f8485c26fce5cdf498a19d46a110067c51d55298f8e15228a93243e6cfbe
Opcode Fuzzy Hash: f4170cc387d222cec35d2f77b4ac0cf96c3b30ebd44371f488536a33f604d273
Instruction Fuzzy Hash: B3425475608301DFD708CF28D85075ABBE1BF88315F19886CE4998B3A1DB75DA85DF82

Function 00B47BF0 Relevance: .6, Instructions: 592COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 159cdd3da1899056587473795a5dfe90383bb0ca5fdad8b5c6173c4fa502925a
Instruction ID: babba30a46d144c54c201f2c42ffe9796a62f6c067c229d271852af1d2537e69
Opcode Fuzzy Hash: 159cdd3da1899056587473795a5dfe90383bb0ca5fdad8b5c6173c4fa502925a
Instruction Fuzzy Hash: 52322170518B108FC368CF29C59052ABBF2FF45700B604AAED6A787F90DB36B945EB10

Function 00B889A0 Relevance: .5, Instructions: 545COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 182b55ffd57e139a3f9eebb98e386ced6b9477778c55ee50db3cb5b8079196fb
Instruction ID: 2afdf5bcc9b02d4e6e85ab29fdbc9ab0b01156b9f6f1df6ed0e97a6385cdab27
Opcode Fuzzy Hash: 182b55ffd57e139a3f9eebb98e386ced6b9477778c55ee50db3cb5b8079196fb
Instruction Fuzzy Hash: 46029B3560C241DFC704EF68E980A2AFBE1FF8A315F0989AEE58587361C735D855CB92

Function 00B88A80 Relevance: .5, Instructions: 524COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32e96120271a432588bde3bf0423b463aa5a2fd05a2653fd55805acfee562b55
Instruction ID: 4898737fdb6c50da5ca6a9cae77ce280a7563229aaaf0d41f572630d1411ece4
Opcode Fuzzy Hash: 32e96120271a432588bde3bf0423b463aa5a2fd05a2653fd55805acfee562b55
Instruction Fuzzy Hash: 7EF1893560C340DFD704EF68D980A2AFBE1FB8A305F09896EE4C587261D736D915CB92

Function 00B88C02 Relevance: .5, Instructions: 487COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1f589a323647ffa8117b8dad15c1b3e18946e4f1ed2e08e0b857af4706a724f
Instruction ID: f7d3e2f98219a1aeb887bd0c69ecfbfd07142998bb30f3a84087a0c4f1ae0d44
Opcode Fuzzy Hash: a1f589a323647ffa8117b8dad15c1b3e18946e4f1ed2e08e0b857af4706a724f
Instruction Fuzzy Hash: 93E19D3161C240CFC704EF28D980A2AF7E1FB8A315F09896DE5D987361D736E915CB92

Function 00B4A300 Relevance: .5, Instructions: 459COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dbf8a9190905fd82ba4d34b3568b61c3c587483ba5650872ac470c2db95d517
Instruction ID: 2261bff1ca23c0bba52c147c39a41fad21e1865a274846b3398a604e64a50a54
Opcode Fuzzy Hash: 8dbf8a9190905fd82ba4d34b3568b61c3c587483ba5650872ac470c2db95d517
Instruction Fuzzy Hash: 8AF1CC766483418FD724CF29C88166BFBE6EFD8300F08886DE4D587752E639EA45CB52

Function 00B88E70 Relevance: .4, Instructions: 420COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d080dad1bf7f7d72d606ed35ac54a46df043a1be4e09d9e8f8cf10ce0d99dd46
Instruction ID: 3e82fb7a6c2e25166e1fc700d5f10582d258e0f013bf6416aad119dff6591eb8
Opcode Fuzzy Hash: d080dad1bf7f7d72d606ed35ac54a46df043a1be4e09d9e8f8cf10ce0d99dd46
Instruction Fuzzy Hash: C5D19B3461C280DFD705EF28D990A2EFBE5FB8A305F4989ADE4C587261D736D811CB92

Function 00B54487 Relevance: .4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc569ece89cbbcf77280b75f27654ac2c1ca96784816903e2060cf104328c9ba
Instruction ID: 4ea2f14d6cc66cb2e02827879d643db68367d8849a6e37100b9110530de835b3
Opcode Fuzzy Hash: cc569ece89cbbcf77280b75f27654ac2c1ca96784816903e2060cf104328c9ba
Instruction Fuzzy Hash: 84E1F2B5501B408FD321CF28D992B97B7E1FF06709F0488ACE4AAC7762DB35A954CB54

Function 00B86CBF Relevance: .4, Instructions: 384COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 124bc3073ee68d6090ec9b22b63dcc1db5a911f52e158f4b686cf1055cb3b616
Instruction ID: a6fb55cc39020699c9dfbe56257e8fb2282db1e588689700bcb72dc74d14889a
Opcode Fuzzy Hash: 124bc3073ee68d6090ec9b22b63dcc1db5a911f52e158f4b686cf1055cb3b616
Instruction Fuzzy Hash: 13D1F136618755CFC721CF78D88052ABBF1EB89314F098AAEE491D73A1DB34DA44CB91

Function 00B87AB0 Relevance: .4, Instructions: 354COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1788055abd6579afd741d9a4a685d906ae50b360ea392eefacef3d0e7d3a0b4c
Instruction ID: 00a01248fd4561dda5cf108e5ee30f52f168a4d726fb8ef09a5611a7ce2b2ba1
Opcode Fuzzy Hash: 1788055abd6579afd741d9a4a685d906ae50b360ea392eefacef3d0e7d3a0b4c
Instruction Fuzzy Hash: DFB10772A483504BD714EA28CC4176BB7E9EBC4318F1849ADE999973A1EB35DC04CB92

Function 00B4AF10 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c6117061885288c1b39a5b943f8482e52345fd8b1a48c2f17ef7dcb0cf10c7c
Instruction ID: 291b2ee8f938b2450a801b66c952cf9220c11ee9cdc33c8e7253dbefbc4c8084
Opcode Fuzzy Hash: 9c6117061885288c1b39a5b943f8482e52345fd8b1a48c2f17ef7dcb0cf10c7c
Instruction Fuzzy Hash: 45C18E72A187418FC360CF68DC96BABB7E1FF85318F08492DD2D9C6242D778A155CB05

Function 00B56536 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72e5a55bf0c7c9dd9e9349bc5dd42198044adc95a5109c8676b433fe8eae085a
Instruction ID: adc540ac9baf33c68fd1d54afd8b0360940b7f83a576859d0b204175b7947de4
Opcode Fuzzy Hash: 72e5a55bf0c7c9dd9e9349bc5dd42198044adc95a5109c8676b433fe8eae085a
Instruction Fuzzy Hash: F5B111B4500B408FD3218F24D981B27BBF2EF56705F54889DE8AA8BB52E775F809CB54

Function 00B87710 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: ee13cbac98456b7012d1fa3e173c76b9943f3eab565ef331a3c4358702a1cad7
Instruction ID: 946c06c2cb377d8c47de3f9c6c2d9f9943dbf46b69e6bf03c7017604da564465
Opcode Fuzzy Hash: ee13cbac98456b7012d1fa3e173c76b9943f3eab565ef331a3c4358702a1cad7
Instruction Fuzzy Hash: C591B07164C301ABE724EF14D880B6FB7E5EB85358F64889CF49497361EB30E940CB92

Function 00B8A0D0 Relevance: .3, Instructions: 282COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d128b4c3dae1c2ba8a0b117f57899bd6105d0f913e0c70fecdbba2e2da96ca00
Instruction ID: 7bbb187d171e7369d55d0cb675b0733cafbd74bea4c40849f3724070a0b510dd
Opcode Fuzzy Hash: d128b4c3dae1c2ba8a0b117f57899bd6105d0f913e0c70fecdbba2e2da96ca00
Instruction Fuzzy Hash: 0B81BF342087018BE724EF28D880A2EB7F5FF49750F0589ADE585D7261E735EC10CB92

Function 00B764F0 Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07639b9059fd7788e958190f91293c8c06ecc47e979201348259189eaaba298e
Instruction ID: c65a7275a5ec7f406464b747e12f06080d9ca93ce245051be96d4888bde8e14a
Opcode Fuzzy Hash: 07639b9059fd7788e958190f91293c8c06ecc47e979201348259189eaaba298e
Instruction Fuzzy Hash: 4171C733B69E904BC3149D7C9C82395AB935BE6334B3DC3B9A9B8CB3E5D9298C055350

Function 00B628E9 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4352810cf61a6436a061e76316bcf1a6791a30c86191935be2221966a05518b0
Instruction ID: 1ec435914d7059ac88149e7f390e482e722411875e0f754e938e3a3ea0d896c2
Opcode Fuzzy Hash: 4352810cf61a6436a061e76316bcf1a6791a30c86191935be2221966a05518b0
Instruction Fuzzy Hash: C76178B44183408BE310AF18D851A2BBBF0FFA6750F18499DF5C59B261E339D910CB67

Function 00B67C00 Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8fec4d96f5ceaddd12e7c1c303662a032e0dad2c036531957ec7e734620e9ae
Instruction ID: 660cadfd817369be2a8e129cfd74e06f8064ec3feb9551ba628fbe748829f3de
Opcode Fuzzy Hash: d8fec4d96f5ceaddd12e7c1c303662a032e0dad2c036531957ec7e734620e9ae
Instruction Fuzzy Hash: 2451D1B16582049BDB209F24CC82B7737F4EF85758F1489A8F9858B290FB79DC05C761

Function 00B71860 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d108e008403b3c92b59985e25fae4eb0cb21936506a5ffd7efe5999b9cc5533
Instruction ID: dedd5260cb158c443c746bb1da91b228881abda1906cffc367ead383dd5b32d0
Opcode Fuzzy Hash: 6d108e008403b3c92b59985e25fae4eb0cb21936506a5ffd7efe5999b9cc5533
Instruction Fuzzy Hash: 11619D316093119BD714CE2CC58072EBBE6EBC5350F64CDAEE4BD8B251D270DD869762

Function 00B782D0 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 621f0b9bd33dceed5b5985a4c8bf5cc048d93b84ba891890be6d42889602b8b5
Instruction ID: 160f7b5d8c86c6f171ddf5a6269fe44dea80f7156a4949fed054a349bf90332e
Opcode Fuzzy Hash: 621f0b9bd33dceed5b5985a4c8bf5cc048d93b84ba891890be6d42889602b8b5
Instruction Fuzzy Hash: B4614B33A9A9914BD315453C5C993A66AC35BE2330F3EC3E6A9B98B3F4CDB94C018351

Function 00B542FC Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab2ad40c4aefd7d6163594516633db355162b728d6706c3471d1bb39400f8626
Instruction ID: a0c93f4146e4eb693503b51d1afdac60dd8895cd9b671de52b09f49fd40c1878
Opcode Fuzzy Hash: ab2ad40c4aefd7d6163594516633db355162b728d6706c3471d1bb39400f8626
Instruction Fuzzy Hash: 9081E0B4810B00AFD360EF39D947757BEF4AB06201F404A5DE8EA97694E730A459CBE3

Function 00C90555 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a80604f9092beebbcaaf95ffe7f7ad9446cd482243ee9a8019353ef38085d5ac
Instruction ID: 867af3be8db1e7cf99facc1ce8bdf15b7ae46a61c9e459529f2d959efc3a6c04
Opcode Fuzzy Hash: a80604f9092beebbcaaf95ffe7f7ad9446cd482243ee9a8019353ef38085d5ac
Instruction Fuzzy Hash: 1A51E3B3E083149FE300AE79ED8476ABBD5EB54720F1A863DDAC4C7784E67958408686

Function 00B7E8A0 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53adb1b22930f8a695f789fdc3f4b943ccd6ac5fb5c634955e3c1cdf4e3fec6a
Instruction ID: 70bb71b10d0494ddf14a5aef4af291bd75573828dd15c94f687c2f1a0b102187
Opcode Fuzzy Hash: 53adb1b22930f8a695f789fdc3f4b943ccd6ac5fb5c634955e3c1cdf4e3fec6a
Instruction Fuzzy Hash: CF516BB16083548FE314DF69D49435BBBE1BB89318F044E2DE4E987391E379DA088F92

Function 00B87520 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8ff15fcd9be35a9e0815d4763ed940fde3dccdcd7f96e471654496ecb0345be
Instruction ID: fe001c7d1201e1eace751b41cf7e4076aa48221443855f458e8bd7070109dd7f
Opcode Fuzzy Hash: e8ff15fcd9be35a9e0815d4763ed940fde3dccdcd7f96e471654496ecb0345be
Instruction Fuzzy Hash: CC51293564C2009BC715AE18DC90B2EB7E6FB85358F388A6CE8E5573A1DB31EC10C791

Function 00C13575 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51cd950135f35a3ac703050e5852eb5eb9b2d93af009769b4c473a919526a902
Instruction ID: 08c16a37a671f06225289aba4a34fae3f308f111552e9ef445b6c87e96d69d0b
Opcode Fuzzy Hash: 51cd950135f35a3ac703050e5852eb5eb9b2d93af009769b4c473a919526a902
Instruction Fuzzy Hash: 3341F5B39082149BE304AE2DDCC576AB7D9EB18360F1A4A3DEEC5D3380F57669008696

Function 00B45A50 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fa1de710abf3373b02cda7dd739a63912ad7f869b2023c4282b2c87244773eb
Instruction ID: efff79eb68955b7748269631e38e2468a4acabd883c0beedf422daff5765a9d8
Opcode Fuzzy Hash: 2fa1de710abf3373b02cda7dd739a63912ad7f869b2023c4282b2c87244773eb
Instruction Fuzzy Hash: 6B51B1B5A05B049FC724DF14C890926B7E1FF89324F1546ACF8998B353D631EE42DB92

Function 00B6EC48 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed100f4ee8fbd6a77150358a61db92e6a28f33c4aaa67ae2443b01384d285a96
Instruction ID: 6b7dbcf768d17e2b3860e8c0470dbe3ea90439f4646b9a5d90edbc01a79ea0e0
Opcode Fuzzy Hash: ed100f4ee8fbd6a77150358a61db92e6a28f33c4aaa67ae2443b01384d285a96
Instruction Fuzzy Hash: 97419D78900316DBDF208F98DC91BA9B7F0FF0A340F144598E955AB3A0EB38A951DB91

Function 00B89B60 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a719338cf97ef7aceeed00c3e9aff4dfd884e1924792cbe3ec8d33cd3a031af
Instruction ID: f20d15a71656e38e38a362180464392d8883e4b08ddbe5711066adac07f1d52b
Opcode Fuzzy Hash: 7a719338cf97ef7aceeed00c3e9aff4dfd884e1924792cbe3ec8d33cd3a031af
Instruction Fuzzy Hash: 5B418334248300ABDB14EF55D990B3EB7E6EB85714F58885DF58A97261D336EC00CF56

Function 00B52030 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73a169a296697803d9bd564366d09ce146b8ba0706a81f71fa1f64d76b187cbf
Instruction ID: 241783f33aab1a9bdfa70df75e0daebc196c00cd2269c0b0626326109d7d1749
Opcode Fuzzy Hash: 73a169a296697803d9bd564366d09ce146b8ba0706a81f71fa1f64d76b187cbf
Instruction Fuzzy Hash: 9B410872A093654FD35CCF29C49033ABBE2AFC5300F0986AEE8D6873D4DA748949D781

Function 00B51E93 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f6b7d01469a76b4f7d64f3e21c541485be7375aab535bfbfcf3e59f2666872d
Instruction ID: 451349aa4360de9d39452c1d561e28b6621c8c27378a1e4f38b81577aff690f5
Opcode Fuzzy Hash: 4f6b7d01469a76b4f7d64f3e21c541485be7375aab535bfbfcf3e59f2666872d
Instruction Fuzzy Hash: 0441E1745083809BD321AB59C884B2EFBF5FB8A345F144D9DFAC497292C376D8188B66

Function 00B88D8A Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bb381643217e8f821fcd98155030ad98be1c3a7165a8662a79b4147e3938f7f
Instruction ID: d5f7dff0a516383929a8c1d194832fd93d8fec06d00ad3f48b4089c767d065dd
Opcode Fuzzy Hash: 2bb381643217e8f821fcd98155030ad98be1c3a7165a8662a79b4147e3938f7f
Instruction Fuzzy Hash: 0341AE316082508FC704EF68C49052EFBE6EF99300F598AAEE4D5E72A1DB75DD01CB82

Function 00CC7EDA Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bb107c3de71eb29c259b6557e774b02519bc6a9eb1411079e73dc59fb366d95
Instruction ID: e7920439c71e36818d824381da5d5ae76276fffd0026c1649ea7b42034d00772
Opcode Fuzzy Hash: 0bb107c3de71eb29c259b6557e774b02519bc6a9eb1411079e73dc59fb366d95
Instruction Fuzzy Hash: D94116F3A1C7018FE304AE39DCC936ABBD6EBA8310F1A853DD68987748E53854064656

Function 00B5D961 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93fa4dbe5a9eb3e0e7a848bba8568abad9025e6806ef7fbda35fa55ce7a78170
Instruction ID: aae37727cf56ee56775c3fbf9db66095a3240d0e6a9e4a56a8cd1d0f4ec55a75
Opcode Fuzzy Hash: 93fa4dbe5a9eb3e0e7a848bba8568abad9025e6806ef7fbda35fa55ce7a78170
Instruction Fuzzy Hash: A941AEB55493818BD7309F14C881BAFB7F0FF96361F040A99E98A8B751E7744940DB93

Function 00C299FD Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c90c829100a69592264548151f0f4fa37847eaf81d317f247e4910b86f5abe8b
Instruction ID: 31c34bab3d15ef9c3bcdd800ea8f7e2d39bb72bcdcbc1e7d9141682d51f39ff0
Opcode Fuzzy Hash: c90c829100a69592264548151f0f4fa37847eaf81d317f247e4910b86f5abe8b
Instruction Fuzzy Hash: AB3128B36186054BE340ED7DDC81777B7D9D784320F26C63DEA85D3344E5B99C124296

Function 00CA78C5 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a7fbd54fdb5036669077f4111ed5f1c9300d44bbf8264879d9304e9cb9d6104
Instruction ID: 45249238fa75d6e0dd9cda637e67b36b8cd5b877587a823eecb235a5b56c644a
Opcode Fuzzy Hash: 4a7fbd54fdb5036669077f4111ed5f1c9300d44bbf8264879d9304e9cb9d6104
Instruction Fuzzy Hash: 923134F3A182148FE348AE2DDC4573BB7E5DB94710F16413DEA8AD3380F9755804828A

Function 00B7F030 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5be6113664422e96713363ec41851647c31506b086c17a8b3ff98e201e465e1
Instruction ID: 18a6a7ed79e7f5c3c6fd21e20373b8eb73ac377eacc44baaadc7522ee82afd52
Opcode Fuzzy Hash: c5be6113664422e96713363ec41851647c31506b086c17a8b3ff98e201e465e1
Instruction Fuzzy Hash: A62137329082254BC3249F59C48153BF7E4FB99704F06C67ED8C8A7295E3359C10C7E6

Function 00B867EF Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a322a6cd64fbd159df429d5f7e2d9d313d664c8f626163b64bbcaf292ffc762
Instruction ID: 87dd203a6fce027f74287b7897b2113c3aaa45a440ed01aa4365ed3c00178f11
Opcode Fuzzy Hash: 7a322a6cd64fbd159df429d5f7e2d9d313d664c8f626163b64bbcaf292ffc762
Instruction Fuzzy Hash: 7231437051C3829AE714DF14C490A2FBBF0EF96788F50684DF4C8AB261D738D985CB9A

Function 00B65E70 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d146b30efbe5754a41e0f718e7312b9eade4ba31f93f2e64140ff67d60cab2d0
Instruction ID: 56b1138e917ad3e05a4bebb426d9e0fc399f3255b20fd0f8a8dbd1e32ad05908
Opcode Fuzzy Hash: d146b30efbe5754a41e0f718e7312b9eade4ba31f93f2e64140ff67d60cab2d0
Instruction Fuzzy Hash: 7B21B071509201DBC720AF28C85196BBBF4EF92764F44895CF4D99B292E339CA10CBA3

Function 00B449A0 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbe2eee255ce80e2df90ed4850d7395439c2c852be5922ee4a7cea5853ec6c97
Instruction ID: 842e810af8c22620eda695bc1672e8acf45b99ba4ca096c0b92405bf36af92d4
Opcode Fuzzy Hash: cbe2eee255ce80e2df90ed4850d7395439c2c852be5922ee4a7cea5853ec6c97
Instruction Fuzzy Hash: 5F31C5316482009FD7149E58D881B2BB7E1FF84359F1889BDE89A9B341D331DE62EB46

Function 00B864B8 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2225ecbdb93f902cc680b13d1918671627148e9b8d11c11c0d673a27e29ecd2
Instruction ID: 37807437d4f0334e945bf433941d89ec9831a2b214db461430130264d20622f4
Opcode Fuzzy Hash: a2225ecbdb93f902cc680b13d1918671627148e9b8d11c11c0d673a27e29ecd2
Instruction Fuzzy Hash: B521627060C2009BC719EF19D980A2EFBE2EB95745F28885CE4C593362C734AC51CB62

Function 00B85700 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5308294a50dfec291611963a7bc0b643755d6695c8f8cce90ce00a8a0e85c517
Instruction ID: 3368e91ee7786629be5d3b8a4d327dca9fa410ca61f79a78c8a6668d020262c7
Opcode Fuzzy Hash: 5308294a50dfec291611963a7bc0b643755d6695c8f8cce90ce00a8a0e85c517
Instruction Fuzzy Hash: 65117C7991C240EBC311BF28E945A1FBBF5EF96B10F058868E4C49B221D735D915CBA3

Function 00B7B650 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: cff103521c363e51821bea013002cfa619d1e0a6731894f43517c18f53f108d4
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 8F11E533A091D80EC7168D3C8440A65FFE35AA3234B59C3D9F4BC9B2D2D722CD8A9764

Function 00B70B80 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90022ddfb32469098a8610d4b68e70bc315f5b0e8987f5b71d64abe4c0da561b
Instruction ID: 47d248a874d37c137ded400d71e04e8bd7a6a2f6e063554697fb20ae930a9181
Opcode Fuzzy Hash: 90022ddfb32469098a8610d4b68e70bc315f5b0e8987f5b71d64abe4c0da561b
Instruction Fuzzy Hash: C101B5F1A2130187E720BE2094D0B3BB2E8AF54718F0885ADD42E97341DB72EE04C291

Function 00B6D1E1 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0fcd2af80b9a08cf777424da03d6350d28f1a567694473f112fa3bf4133f752
Instruction ID: b6003973321e706ff500837b28267271ae0ffa20837c98379bc650ae62c209a7
Opcode Fuzzy Hash: a0fcd2af80b9a08cf777424da03d6350d28f1a567694473f112fa3bf4133f752
Instruction Fuzzy Hash: 3C111CB0408380AFD310AF61C494A2FFBE0EBA6714F248C4DF2A49B251C379E809CF16

Function 00B46EA0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cf77aec9dd6eeeba17b6ae3b87ad13c6363caa4f5f73d6decb2fa4ac3ac812f
Instruction ID: 1056fe93a0043feeb3048f3bcf0389f3128f28650acaf8ab19b1333da421f22e
Opcode Fuzzy Hash: 1cf77aec9dd6eeeba17b6ae3b87ad13c6363caa4f5f73d6decb2fa4ac3ac812f
Instruction Fuzzy Hash: 9BF0E93EB5921A4BE210CDBAE8C4C3BF3D6D7DA355B145538EE81D3211DD72E806A2D1

Function 00B7B8C0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dad40b8a8b0cf0c680be38028a9801f4e1e9da1297b4f3b9e1d9df466e9bee7e
Instruction ID: 6506d07c58c905065930edc77b6421f51c28c54387ea28b09faa2761b04cb969
Opcode Fuzzy Hash: dad40b8a8b0cf0c680be38028a9801f4e1e9da1297b4f3b9e1d9df466e9bee7e
Instruction Fuzzy Hash: 1E0162B3A199610B8348CE3DDC1156BBAD15BD5770F19872DBEF5CB3E0D230C8118695

Function 00B5C5F0 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8ebd7708255391ffa87ed53dd5dbf97c7cff7b52fcdad9dabb06971c835301f
Instruction ID: afd6f86e1ed7dc578beff9a6215ab27dc393fb41cabbec3b70aacfa27007612f
Opcode Fuzzy Hash: d8ebd7708255391ffa87ed53dd5dbf97c7cff7b52fcdad9dabb06971c835301f
Instruction Fuzzy Hash: EB014B72A196204B8308CE3C9C1112ABEE19B86330F158B2EBCFAD73E0D664CD548696

Function 00B5B410 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 809ee23363f840c811a801533be2b64f834fb93f4c5a4ab9cc37b5a2fd812bb4
Instruction ID: 72e4f265602935bacf2f2a553dc172e6996142c28d863925b8365185e1ecd4f7
Opcode Fuzzy Hash: 809ee23363f840c811a801533be2b64f834fb93f4c5a4ab9cc37b5a2fd812bb4
Instruction Fuzzy Hash: CCF0A0B1A046106BDF328A549C80F37BBDCCB9B365F1904E6EC8597283D261A849C3E6

Function 00B78220 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7621be4007d857418cec1e0675bcd81cfd3822250e95f45e158a643ac9f33aed
Instruction ID: b1ffb981b9ada4a75f3469242504121e2196e7f76758adfd313d8ecdd77c5063
Opcode Fuzzy Hash: 7621be4007d857418cec1e0675bcd81cfd3822250e95f45e158a643ac9f33aed
Instruction Fuzzy Hash: 0001EFB4410B009FC360EF29C845B4BBBE8EB08714F008A1DE8AECB690D770A548CF82

Function 00B81440 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction ID: 74fc41e568673df207b854ce833503af1ce210a73eb57f288242e81550d4b636
Opcode Fuzzy Hash: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction Fuzzy Hash: 1CD05E2160932186AB649E1DA4009B7F7E4EA87B11F4D999EF586E3258D230DC42C6A9

Function 00B51ACD Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 286e3181860f6b57218d227978ad481aa237504253784dcc7fd2349fc30eb291
Instruction ID: d287edab49919ee03d8f776fcac34a5541dec75543b44bd6b3bed69c71dfa93e
Opcode Fuzzy Hash: 286e3181860f6b57218d227978ad481aa237504253784dcc7fd2349fc30eb291
Instruction Fuzzy Hash: 57C01238A190028B82048F04A8A5A32A3B8A307209704602BDA02E3331DE20C416CA09

Function 00B86094 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 238260984fe87c85a721f2ed7082c6a3cde489da1dc487ca4d14eb256892e924
Instruction ID: 32c33010d1e1e7ac8ebb6b7ffc514f2a52120e4855d8b7dcafa42959f13bb2d0
Opcode Fuzzy Hash: 238260984fe87c85a721f2ed7082c6a3cde489da1dc487ca4d14eb256892e924
Instruction Fuzzy Hash: 45C09B3865C04087D14CCF04DA55475F3F69B97F14724B05FC80623255C534D512D51C

Function 00B51A3C Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fb04302982c35d3f97903a9e332f7a98256c9c06d55f4b597858bf76e5302ab
Instruction ID: f44a0294c3ea4234a3ecabd7f96b45a5620cf4a6eca515efcfddbe3fdedda50a
Opcode Fuzzy Hash: 2fb04302982c35d3f97903a9e332f7a98256c9c06d55f4b597858bf76e5302ab
Instruction Fuzzy Hash: B0C09B34E59041CBC244CF89E8E1532A3FC5317209714347B9B13F7371D960D415C709

Function 00B85FD6 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1784996435.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.1784985940.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785029510.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785042986.0000000000BAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785054258.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785065734.0000000000BAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785146202.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785158061.0000000000CFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785172974.0000000000D1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785200182.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785211385.0000000000D25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785224502.0000000000D30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785236357.0000000000D36000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785250496.0000000000D4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785261871.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785273715.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785284780.0000000000D4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785297068.0000000000D56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785310075.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785327393.0000000000D84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785341937.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785353929.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785366537.0000000000D95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785377781.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785388868.0000000000D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785400591.0000000000DA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785411426.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785422939.0000000000DA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785434125.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785445875.0000000000DAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785456804.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785467579.0000000000DB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785479387.0000000000DB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785490022.0000000000DB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785500635.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785511317.0000000000DBB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785522428.0000000000DC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785537346.0000000000DDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785549248.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785580417.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785592243.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785603216.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785626982.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785637876.0000000000E41000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f0d8b9c10bc5af5236a197428413a9efccd0c072aceb62d8c21bda77a7d9197
Instruction ID: 088906dc4e9fcb9420f445554f5cedfb9f9d35b21b58c5d27e20bdb24c0bd62f
Opcode Fuzzy Hash: 6f0d8b9c10bc5af5236a197428413a9efccd0c072aceb62d8c21bda77a7d9197
Instruction Fuzzy Hash: A7C09228B680008BA28CCF18DE55936F2FA9B8BF18B14B02EC806A3256D934D512860C

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Boot Survival

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Windows Analysis Report
file.exe

Function 00B850FA Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 63
libraryCOMMON

Function 00B4FCA0 Relevance: 5.4, Strings: 4, Instructions: 373
COMMON

Function 00B4D110 Relevance: 1.7, APIs: 1, Instructions: 168
COMMON

Function 00B85BB0 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Function 00B8695B Relevance: 1.4, Strings: 1, Instructions: 100
COMMON

Function 00B5049B Relevance: .3, Instructions: 264
COMMON

Function 00B50228 Relevance: .2, Instructions: 218
COMMON

Function 00B83220 Relevance: 1.6, APIs: 1, Instructions: 59
memoryCOMMON

Function 00B83202 Relevance: 1.5, APIs: 1, Instructions: 6
memoryCOMMON