Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1538207
MD5:	7a359b81462a150726f40ae4d2ca23d5
SHA1:	07cc406c2b3ffdc91180d0b63b72326b6e14afd2
SHA256:	09c2ebee2e986aa2147ae54994262812f682a9534335b4843d486765e83f56ca
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

PE file contains section with special chars

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Detected potential crypto function

Entry point lies outside standard sections

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 6372 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 7A359B81462A150726F40AE4D2CA23D5)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["dissapoiznw.store", "mobbipenju.store", "spirittunek.store", "bathdoomgaz.store", "licendfilteo.site", "studennotediw.store", "eaglepawnoy.store", "clearancek.site"], "Build id": "4SD0y4--legendaryy"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-20T20:14:59.486612+0200	2054653	1	A Network Trojan was detected	192.168.2.4	49731	104.21.53.8	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-20T20:14:59.486612+0200	2049836	1	A Network Trojan was detected	192.168.2.4	49731	104.21.53.8	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-20T20:14:56.403458+0200	2056477	1	Domain Observed Used for C2 Detected	192.168.2.4	52800	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-20T20:14:56.284591+0200	2056471	1	Domain Observed Used for C2 Detected	192.168.2.4	64746	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-20T20:14:56.379461+0200	2056481	1	Domain Observed Used for C2 Detected	192.168.2.4	59934	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-20T20:14:56.356741+0200	2056483	1	Domain Observed Used for C2 Detected	192.168.2.4	53536	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-20T20:14:56.431526+0200	2056473	1	Domain Observed Used for C2 Detected	192.168.2.4	49808	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-20T20:14:56.296573+0200	2056485	1	Domain Observed Used for C2 Detected	192.168.2.4	57392	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-20T20:14:56.417088+0200	2056475	1	Domain Observed Used for C2 Detected	192.168.2.4	49285	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-20T20:14:56.391847+0200	2056479	1	Domain Observed Used for C2 Detected	192.168.2.4	63702	1.1.1.1	53	UDP

ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-20T20:14:58.475439+0200	2858666	1	Domain Observed Used for C2 Detected	192.168.2.4	49730	104.102.49.254	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://steamcommunity.com:443/profiles/76561199724331900

URL Reputation: Label: malware

Found malware configuration

Source: file.exe.6372.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["dissapoiznw.store", "mobbipenju.store", "spirittunek.store", "bathdoomgaz.store", "licendfilteo.site", "studennotediw.store", "eaglepawnoy.store", "clearancek.site"], "Build id": "4SD0y4--legendaryy"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp	String decryptor: clearancek.site
Source: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp	String decryptor: licendfilteo.site
Source: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp	String decryptor: spirittunek.store
Source: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp	String decryptor: bathdoomgaz.store
Source: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp	String decryptor: studennotediw.store
Source: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp	String decryptor: dissapoiznw.store
Source: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp	String decryptor: eaglepawnoy.store
Source: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp	String decryptor: mobbipenju.store
Source: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp	String decryptor: clearancek.site
Source: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp	String decryptor: 4SD0y4--legendaryy

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.4:49731 version: TLS 1.2

Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_0055D110
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_0055D110
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	0_2_005963B8
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00595700
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 27BAF212h	0_2_0059695B
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	0_2_005999D0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	0_2_0055FCA0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	0_2_00560EEC
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	0_2_00594040
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ecx, dword ptr [edx]	0_2_00551000
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then dec ebx	0_2_0058F030
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+20h]	0_2_00566F91
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp ecx	0_2_00596094
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	0_2_0057D1E1
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_00572260
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [esi], ax	0_2_00572260
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	0_2_005642FC
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ebp, eax	0_2_0055A300
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_005823E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_005823E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_005823E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_005823E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_005823E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+14h]	0_2_005823E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_0056D457
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx eax, word ptr [esi+ecx]	0_2_00591440
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	0_2_0057C470
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov dword ptr [esp], 00000000h	0_2_0056B410
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	0_2_0057E40C
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	0_2_005964B8
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_00579510
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	0_2_00566536
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 7789B0CBh	0_2_00597520
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	0_2_0058B650
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	0_2_0057E66A
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ecx, word ptr [edi+eax]	0_2_00597710
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	0_2_005967EF
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	0_2_0057D7AF
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_005728E9
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	0_2_0056D961
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 62429966h	0_2_00593920
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	0_2_005549A0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ebx]	0_2_00555A50
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	0_2_00594A40
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	0_2_00561A3C
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	0_2_00561ACD
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	0_2_00599B60
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+000006B8h]	0_2_0056DB6F
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F8FD61B8h	0_2_0056DB6F
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	0_2_00563BE2
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	0_2_00561BEE
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	0_2_00580B80
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp word ptr [eax+esi+02h], 0000h	0_2_0057EC48
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	0_2_00577C00
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], A70A987Fh	0_2_0058FC20
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], C85F7986h	0_2_0057CCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_0057CCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C85F7986h	0_2_0057CCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00599CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebp+edx*8+00h], 9ECF05EBh	0_2_00599CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	0_2_0057AC91
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [edx], ax	0_2_0057AC91
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov dword ptr [esp+1Ch], 5E46585Eh	0_2_0057FD10
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	0_2_0057DD29
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00598D8A
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ebx, word ptr [ecx]	0_2_0057AE57
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00575E70
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_00577E60
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov edi, ecx	0_2_00564E2A
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	0_2_00561E93
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ecx, word ptr [ebp+00h]	0_2_0055BEB0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp byte ptr [ebx], 00000000h	0_2_00566EBF
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edi, byte ptr [ecx+esi]	0_2_00556EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_0058FF70
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	0_2_00579F62
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp ecx	0_2_00558FD0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [edx], 0000h	0_2_0056FFDF
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp ecx	0_2_00595FD6
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], F3285E74h	0_2_00597FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00597FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+20h]	0_2_00566F91

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2056479 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store) : 192.168.2.4:63702 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056477 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store) : 192.168.2.4:52800 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056485 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store) : 192.168.2.4:57392 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056473 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site) : 192.168.2.4:49808 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056483 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store) : 192.168.2.4:53536 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056471 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site) : 192.168.2.4:64746 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056481 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store) : 192.168.2.4:59934 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056475 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store) : 192.168.2.4:49285 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49731 -> 104.21.53.8:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49731 -> 104.21.53.8:443
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.4:49730 -> 104.102.49.254:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: dissapoiznw.store
Source: Malware configuration extractor	URLs: mobbipenju.store
Source: Malware configuration extractor	URLs: spirittunek.store
Source: Malware configuration extractor	URLs: bathdoomgaz.store
Source: Malware configuration extractor	URLs: licendfilteo.site
Source: Malware configuration extractor	URLs: studennotediw.store
Source: Malware configuration extractor	URLs: eaglepawnoy.store
Source: Malware configuration extractor	URLs: clearancek.site

Source: Joe Sandbox View	IP Address: 104.21.53.8 104.21.53.8
Source: Joe Sandbox View	IP Address: 104.102.49.254 104.102.49.254

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: AKAMAI-ASUS AKAMAI-ASUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: sergei-esenin.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com

Source: file.exe, 00000000.00000003.1694741062.0000000000CBA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C0e3d185a3e106e73b244decdec33a0ea; Path=/; Secure; HttpOnly; SameSite=Nonesessionid=e6a0f35c3786079464e2950d; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type34508Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveSun, 20 Oct 2024 18:14:58 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-Control equals www.youtube.com (Youtube)
Source: file.exe, 00000000.00000003.1694741062.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: LRPC-e9c77b0923665da6f1captcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: captcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: file.exe, 00000000.00000003.1694741062.0000000000CBA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: clearancek.site
Source: global traffic	DNS traffic detected: DNS query: mobbipenju.store
Source: global traffic	DNS traffic detected: DNS query: eaglepawnoy.store
Source: global traffic	DNS traffic detected: DNS query: dissapoiznw.store
Source: global traffic	DNS traffic detected: DNS query: studennotediw.store
Source: global traffic	DNS traffic detected: DNS query: bathdoomgaz.store
Source: global traffic	DNS traffic detected: DNS query: spirittunek.store
Source: global traffic	DNS traffic detected: DNS query: licendfilteo.site
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: sergei-esenin.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: sergei-esenin.com

Source: global traffic

HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Sun, 20 Oct 2024 18:14:59 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Frame-Options: SAMEORIGINReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7NBve1yZenzcS24YSNAg1NZSkRWPUyTYji1ee7z3FEEY4zhZTRD5CWlyA%2F9LQVKB6eW9LFhx37SWaOAm6iIHFnMEudmJiVr%2BAMtOpWlEFn4w0xzV4C5kbz8zIc%2FyGvMplhRwTg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8d5afd9d4b962ac0-LAX

Source: file.exe, 00000000.00000003.1694741062.0000000000CBA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: file.exe, 00000000.00000003.1694741062.0000000000CBA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: file.exe, 00000000.00000003.1694741062.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694741062.0000000000C97000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.fastly.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: file.exe, 00000000.00000003.1694741062.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.fastly.steamstatic.com/fef49e7fa7e1997310d705b2a619$e
Source: file.exe, 00000000.00000003.1694741062.0000000000CBA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: file.exe, 00000000.00000003.1694741062.0000000000CBA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/
Source: file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: file.exe, 00000000.00000002.1707016572.0000000000C6F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000C6F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clearancek.site:443/api_
Source: file.exe, 00000000.00000002.1707016572.0000000000C6F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000C6F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clearancek.site:443/apif
Source: file.exe, 00000000.00000003.1703595779.0000000000D0A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1707198878.0000000000D0A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.stea):
Source: file.exe, 00000000.00000002.1707016572.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694741062.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steam
Source: file.exe, 00000000.00000003.1703595779.0000000000D0A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1707198878.0000000000D0A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamsta
Source: file.exe, 00000000.00000003.1703595779.0000000000D0A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1707198878.0000000000D0A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.
Source: file.exe, 00000000.00000003.1694741062.0000000000CBA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/
Source: file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694741062.0000000000C97000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/css/applications/community/main.css?v=DVae4t4RZiHA&l=en
Source: file.exe, 00000000.00000002.1707016572.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694741062.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/css/globalv2.css?v=dQy8Omh4p9PH&l=english
Source: file.exe, 00000000.00000002.1707016572.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694741062.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/css/promo/summer2017/stickers.css?v=P8gOPraCSjV6&l=engl
Source: file.exe, 00000000.00000002.1707016572.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694741062.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/css/skin_1/header.css?v=pTvrRy1pm52p&l=english
Source: file.exe, 00000000.00000002.1707016572.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694741062.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1
Source: file.exe, 00000000.00000002.1707016572.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694741062.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/css/skin_1/profilev2.css?v=t9xiI4DlPpEB&l=english
Source: file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694741062.0000000000C97000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694741062.0000000000C97000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/javascript/applications/community/libraries~b28b7af69.js?v=
Source: file.exe, 00000000.00000002.1707016572.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694741062.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694741062.0000000000C97000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/javascript/applications/community/main.js?v=4XouecKy8sZy&am
Source: file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694741062.0000000000C97000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/javascript/applications/community/manifest.js?v=r7a4-LYcQOj
Source: file.exe, 00000000.00000002.1707016572.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694741062.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/javascript/global.js?v=7qlUmHSJhPRN&l=english
Source: file.exe, 00000000.00000002.1707016572.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694741062.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC
Source: file.exe, 00000000.00000002.1707016572.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694741062.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/javascript/modalContent.js?v=XpCpv
Source: file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/javascript/modalContent.js?v=XpCpvP7feUoO&l=english
Source: file.exe, 00000000.00000002.1707016572.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694741062.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english
Source: file.exe, 00000000.00000002.1707016572.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694741062.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/javascript/profile.js?v=bbs9uq0gqJ-H&l=english
Source: file.exe, 00000000.00000002.1707016572.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694741062.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/javascript/promo/stickers.js?v=W8NP8aTVqtms&l=english
Source: file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694741062.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw
Source: file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=english
Source: file.exe, 00000000.00000002.1707016572.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694741062.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=
Source: file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL&l=
Source: file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/javascript/webui/clientcom.js?v=jq1jQyX1843y&l=english
Source: file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/shared/css/buttons.css?v=-WV9f1LdxEjq&l=english
Source: file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694741062.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/shared/css/motiva_sans.css?v=v7XTmVzbLV33&l=english
Source: file.exe, 00000000.00000002.1707016572.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694741062.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/shared/css/sh
Source: file.exe, 00000000.00000002.1707016572.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694741062.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/shared/css/shared_global.css?v=uF6G1wyNU-4c&l=english
Source: file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/shared/css/shared_responsive.css?v=kR9MtmbWSZEp&l=engli
Source: file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: file.exe, 00000000.00000002.1707016572.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694741062.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1&l=engl
Source: file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/shared/javascript/shared_global.js?v=7glT1n_nkVCs&l=eng
Source: file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSvIAKtunf
Source: file.exe, 00000000.00000002.1707016572.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694741062.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0
Source: file.exe, 00000000.00000002.1707016572.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694741062.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstu
Source: file.exe, 00000000.00000002.1707016572.0000000000C6F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000C6F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://eaglepawnoy.store:443/apiG
Source: file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: file.exe, 00000000.00000002.1707016572.0000000000C6F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000C6F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://licendfilteo.site:443/api8
Source: file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: file.exe, 00000000.00000003.1694741062.0000000000CBA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: file.exe, 00000000.00000003.1694741062.0000000000CBA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: file.exe, 00000000.00000002.1707016572.0000000000C6F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000C6F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mobbipenju.store:443/apibcryptPrimitives.dll%
Source: file.exe, 00000000.00000003.1694741062.0000000000CBA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: file.exe, 00000000.00000003.1694741062.0000000000CBA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: file.exe, 00000000.00000003.1694741062.0000000000CBA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: file.exe, 00000000.00000003.1694741062.0000000000CBA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: file.exe, 00000000.00000003.1694741062.0000000000CBA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1707198878.0000000000D0A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/
Source: file.exe, 00000000.00000003.1703595779.0000000000D0A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1707198878.0000000000D0A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/5L
Source: file.exe, 00000000.00000003.1694741062.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000C66000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1707198878.0000000000D0A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/api
Source: file.exe, 00000000.00000003.1694741062.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/apiU
Source: file.exe, 00000000.00000003.1703595779.0000000000D0A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1707198878.0000000000D0A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/apiin
Source: file.exe, 00000000.00000002.1707016572.0000000000C6F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000C6F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com:443/api
Source: file.exe, 00000000.00000002.1707016572.0000000000C6F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000C6F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com:443/api~
Source: file.exe, 00000000.00000003.1694741062.0000000000CBA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: file.exe, 00000000.00000003.1694741062.0000000000CBA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: file.exe, 00000000.00000003.1694741062.0000000000CBA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: file.exe, 00000000.00000003.1694741062.0000000000CBA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: file.exe, 00000000.00000003.1694741062.0000000000CBA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: file.exe, 00000000.00000003.1694850677.0000000000C87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: file.exe, 00000000.00000002.1707016572.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694741062.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694741062.0000000000C97000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: file.exe, 00000000.00000002.1707016572.0000000000C6F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000C6F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com:443/profiles/76561199724331900
Source: file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: file.exe, 00000000.00000003.1694741062.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694741062.0000000000CBA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: file.exe, 00000000.00000003.1694741062.0000000000CBA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C0e3d185a3e106e7
Source: file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: file.exe, 00000000.00000002.1707016572.0000000000C6F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000C6F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://studennotediw.store:443/api
Source: file.exe, 00000000.00000003.1702917421.0000000000CBA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1707016572.0000000000CBA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/5
Source: file.exe, 00000000.00000003.1694712578.0000000000D02000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694741062.0000000000CBA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694850677.0000000000C87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/5xx-error-landing
Source: file.exe, 00000000.00000003.1694741062.0000000000CBA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/learning/acces
Source: file.exe, 00000000.00000002.1707016572.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694741062.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/learning/access-management/phishing-attack/
Source: file.exe, 00000000.00000003.1694741062.0000000000CBA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: file.exe, 00000000.00000003.1694741062.0000000000CBA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: file.exe, 00000000.00000003.1694741062.0000000000CBA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: file.exe, 00000000.00000003.1694741062.0000000000CBA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: file.exe, 00000000.00000003.1702540658.0000000000D10000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: file.exe, 00000000.00000003.1694741062.0000000000CBA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: file.exe, 00000000.00000003.1694741062.0000000000CBA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.4:49731 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00560228	0_2_00560228
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0058F620	0_2_0058F620
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00594040	0_2_00594040
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00551000	0_2_00551000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00562030	0_2_00562030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0059A0D0	0_2_0059A0D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00555160	0_2_00555160
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005571F0	0_2_005571F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007251C4	0_2_007251C4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0055E1A0	0_2_0055E1A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0071B213	0_2_0071B213
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0071820E	0_2_0071820E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005882D0	0_2_005882D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005812D0	0_2_005812D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005512F7	0_2_005512F7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0055A300	0_2_0055A300
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005823E0	0_2_005823E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0055B3A0	0_2_0055B3A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005513A3	0_2_005513A3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0057C470	0_2_0057C470
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005864F0	0_2_005864F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0056049B	0_2_0056049B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00564487	0_2_00564487
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0056C5F0	0_2_0056C5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0068E5B1	0_2_0068E5B1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005535B0	0_2_005535B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00598652	0_2_00598652
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0055164F	0_2_0055164F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005986F0	0_2_005986F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0071E76B	0_2_0071E76B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006F37B2	0_2_006F37B2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00581860	0_2_00581860
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0058B8C0	0_2_0058B8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0058E8A0	0_2_0058E8A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006C197A	0_2_006C197A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006BC95F	0_2_006BC95F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0057098B	0_2_0057098B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005989A0	0_2_005989A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00594A40	0_2_00594A40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00651A5C	0_2_00651A5C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00598A80	0_2_00598A80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00597AB0	0_2_00597AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005BCAAB	0_2_005BCAAB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0056DB6F	0_2_0056DB6F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00632B37	0_2_00632B37
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00557BF0	0_2_00557BF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00598C02	0_2_00598C02
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0057CCD0	0_2_0057CCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00596CBF	0_2_00596CBF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00722D66	0_2_00722D66
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00578D62	0_2_00578D62
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0057FD10	0_2_0057FD10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0071CD19	0_2_0071CD19
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0057DD29	0_2_0057DD29
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0057AE57	0_2_0057AE57
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00598E70	0_2_00598E70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00564E2A	0_2_00564E2A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0055BEB0	0_2_0055BEB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00566EBF	0_2_00566EBF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0055AF10	0_2_0055AF10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00558FD0	0_2_00558FD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00597FC0	0_2_00597FC0

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 0055CAA0 appears 48 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 0056D300 appears 152 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: ZLIB complexity 0.9994520936468647

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@10/2

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00588220 CoCreateInstance,

0_2_00588220

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: file.exe

Static file information: File size 2905088 > 1048576

Source: file.exe

Static PE information: Raw size of qvddldgl is bigger than: 0x100000 < 0x29be00

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.550000.0.unpack :EW;.rsrc :W;.idata :W;qvddldgl:EW;dpjuhttd:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W;qvddldgl:EW;dpjuhttd:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x2d4613 should be: 0x2c61dd

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name: qvddldgl
Source: file.exe	Static PE information: section name: dpjuhttd
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0084C000 push ecx; mov dword ptr [esp], 106DAD21h	0_2_0084C02D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0084C000 push ebp; mov dword ptr [esp], edx	0_2_0084C038
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0084C000 push ebp; mov dword ptr [esp], esi	0_2_0084C16D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007380E0 push 5706F4F1h; mov dword ptr [esp], edx	0_2_00738130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007FF0EA push ecx; mov dword ptr [esp], eax	0_2_007FF1B6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0084C04B push ebp; mov dword ptr [esp], esi	0_2_0084C16D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0084C1AF push edi; mov dword ptr [esp], 5B01E677h	0_2_0084C1BF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0084C1AF push esi; mov dword ptr [esp], 79711C00h	0_2_0084C1E5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00786132 push 7496B363h; mov dword ptr [esp], edx	0_2_00786176
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00786132 push ebx; mov dword ptr [esp], edi	0_2_007861A6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008001DD push 76C6F48Bh; mov dword ptr [esp], ebp	0_2_008001EE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007251C4 push esi; mov dword ptr [esp], ebp	0_2_0072521A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007251C4 push 750F640Eh; mov dword ptr [esp], ebp	0_2_007252B1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007251C4 push 72635506h; mov dword ptr [esp], eax	0_2_007252DE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007251C4 push 7EC77604h; mov dword ptr [esp], eax	0_2_00725480
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007251C4 push 7CF281D2h; mov dword ptr [esp], ecx	0_2_00725488
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007251C4 push 124ED0A0h; mov dword ptr [esp], edi	0_2_007254D7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007251C4 push esi; mov dword ptr [esp], eax	0_2_0072557E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007251C4 push 0809D7D8h; mov dword ptr [esp], edx	0_2_00725586
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007251C4 push eax; mov dword ptr [esp], 22A24D00h	0_2_007255B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007251C4 push 65E147C3h; mov dword ptr [esp], esi	0_2_007255F3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007251C4 push ebp; mov dword ptr [esp], edx	0_2_0072564B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007251C4 push eax; mov dword ptr [esp], edx	0_2_00725702
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007251C4 push ecx; mov dword ptr [esp], edi	0_2_007257B2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007251C4 push ecx; mov dword ptr [esp], edx	0_2_007257B8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007251C4 push edx; mov dword ptr [esp], edi	0_2_00725802
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007251C4 push 0D1B1E54h; mov dword ptr [esp], ebp	0_2_00725895
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007251C4 push 3B1027ABh; mov dword ptr [esp], edx	0_2_007258A6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007251C4 push edi; mov dword ptr [esp], 0243ABA4h	0_2_007258F4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007251C4 push 16697DA3h; mov dword ptr [esp], eax	0_2_00725938
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007251C4 push 5FE8B8E6h; mov dword ptr [esp], eax	0_2_007259C5

Source: file.exe

Static PE information: section name: entropy: 7.97591323533163

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B3EF7 second address: 5B3EFD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72AD01 second address: 72AD43 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF7A0B38036h 0x00000008 jmp 00007FF7A0B38035h 0x0000000d push edi 0x0000000e pop edi 0x0000000f popad 0x00000010 push ecx 0x00000011 pushad 0x00000012 popad 0x00000013 pop ecx 0x00000014 pop edx 0x00000015 pop eax 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 je 00007FF7A0B38026h 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72AD43 second address: 72AD47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 729DF8 second address: 729E0C instructions: 0x00000000 rdtsc 0x00000002 je 00007FF7A0B38026h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b push edx 0x0000000c jl 00007FF7A0B3802Eh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 729F5B second address: 729F5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 729F5F second address: 729F6A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72A21D second address: 72A242 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FF7A105DEAFh 0x0000000e jmp 00007FF7A105DEADh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72A384 second address: 72A388 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72A388 second address: 72A38C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72A38C second address: 72A398 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FF7A0B38026h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72A398 second address: 72A39D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72A39D second address: 72A3A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72A3A6 second address: 72A3C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF7A105DEB7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72A3C1 second address: 72A3C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72A3C7 second address: 72A3D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72A3D4 second address: 72A3D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72A526 second address: 72A53E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7A105DEAFh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72A53E second address: 72A544 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72A544 second address: 72A54D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72A54D second address: 72A551 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72A551 second address: 72A562 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jl 00007FF7A105DEA6h 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72A562 second address: 72A598 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 jmp 00007FF7A0B38039h 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 jmp 00007FF7A0B3802Fh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72A598 second address: 72A5A8 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FF7A105DEA6h 0x00000008 jnc 00007FF7A105DEA6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72D2A4 second address: 72D2AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72D2AC second address: 72D2D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FF7A105DEB3h 0x0000000d pop edx 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 pushad 0x00000013 pushad 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 pushad 0x00000017 popad 0x00000018 popad 0x00000019 pushad 0x0000001a pushad 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72D2D8 second address: 72D319 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov eax, dword ptr [eax] 0x00000008 pushad 0x00000009 jmp 00007FF7A0B38034h 0x0000000e pushad 0x0000000f push esi 0x00000010 pop esi 0x00000011 jmp 00007FF7A0B38035h 0x00000016 popad 0x00000017 popad 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 push esi 0x00000021 pop esi 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72D319 second address: 72D31F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72D31F second address: 72D325 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72D325 second address: 5B3EF7 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 mov edx, dword ptr [ebp+122D3CEFh] 0x0000000f push dword ptr [ebp+122D0D21h] 0x00000015 mov ecx, dword ptr [ebp+122D3D97h] 0x0000001b call dword ptr [ebp+122D24CFh] 0x00000021 pushad 0x00000022 jmp 00007FF7A105DEB4h 0x00000027 xor eax, eax 0x00000029 pushad 0x0000002a adc esi, 6AE61E96h 0x00000030 mov edi, dword ptr [ebp+122D3C8Fh] 0x00000036 popad 0x00000037 mov edx, dword ptr [esp+28h] 0x0000003b pushad 0x0000003c mov ecx, dword ptr [ebp+122D3C7Fh] 0x00000042 jmp 00007FF7A105DEAEh 0x00000047 popad 0x00000048 pushad 0x00000049 movsx ecx, dx 0x0000004c popad 0x0000004d mov dword ptr [ebp+122D3B33h], eax 0x00000053 mov dword ptr [ebp+122D1D1Dh], edx 0x00000059 mov esi, 0000003Ch 0x0000005e stc 0x0000005f add esi, dword ptr [esp+24h] 0x00000063 jng 00007FF7A105DEACh 0x00000069 sub dword ptr [ebp+122D1D1Dh], eax 0x0000006f lodsw 0x00000071 pushad 0x00000072 mov dh, 17h 0x00000074 mov esi, dword ptr [ebp+122D3D3Fh] 0x0000007a popad 0x0000007b add eax, dword ptr [esp+24h] 0x0000007f jmp 00007FF7A105DEB1h 0x00000084 mov ebx, dword ptr [esp+24h] 0x00000088 jmp 00007FF7A105DEB6h 0x0000008d push eax 0x0000008e push eax 0x0000008f push edx 0x00000090 jnp 00007FF7A105DEBAh 0x00000096 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72D351 second address: 72D385 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edi 0x00000006 mov dword ptr [esp], eax 0x00000009 mov dword ptr [ebp+122D2AB6h], ebx 0x0000000f push 00000000h 0x00000011 sub dword ptr [ebp+1244CCA7h], edx 0x00000017 jng 00007FF7A0B3802Eh 0x0000001d push 108126DAh 0x00000022 push eax 0x00000023 push edx 0x00000024 push esi 0x00000025 jne 00007FF7A0B38026h 0x0000002b pop esi 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72D385 second address: 72D410 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor dword ptr [esp], 1081265Ah 0x0000000f movzx esi, si 0x00000012 push 00000003h 0x00000014 and ecx, dword ptr [ebp+122D3C53h] 0x0000001a push 00000000h 0x0000001c or dword ptr [ebp+122D1CFBh], eax 0x00000022 push 00000003h 0x00000024 mov esi, dword ptr [ebp+122D3BFBh] 0x0000002a call 00007FF7A105DEA9h 0x0000002f jmp 00007FF7A105DEB2h 0x00000034 push eax 0x00000035 push edx 0x00000036 push edi 0x00000037 jng 00007FF7A105DEA6h 0x0000003d pop edi 0x0000003e pop edx 0x0000003f mov eax, dword ptr [esp+04h] 0x00000043 js 00007FF7A105DEB7h 0x00000049 jmp 00007FF7A105DEB1h 0x0000004e mov eax, dword ptr [eax] 0x00000050 jnl 00007FF7A105DEB4h 0x00000056 mov dword ptr [esp+04h], eax 0x0000005a push eax 0x0000005b push edx 0x0000005c push eax 0x0000005d push edx 0x0000005e push ecx 0x0000005f pop ecx 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72D410 second address: 72D416 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72D416 second address: 72D425 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF7A105DEABh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72D4B3 second address: 72D4BD instructions: 0x00000000 rdtsc 0x00000002 jng 00007FF7A0B38026h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72D4BD second address: 72D4C2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72D610 second address: 72D620 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FF7A0B38026h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72D620 second address: 72D625 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72D625 second address: 72D65F instructions: 0x00000000 rdtsc 0x00000002 jns 00007FF7A0B38028h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b jmp 00007FF7A0B38030h 0x00000010 push 00000000h 0x00000012 mov esi, dword ptr [ebp+122D3BABh] 0x00000018 push 92AD7648h 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007FF7A0B3802Eh 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72D65F second address: 72D6F3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7A105DEB0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 6D528A38h 0x00000010 push 00000000h 0x00000012 push edi 0x00000013 call 00007FF7A105DEA8h 0x00000018 pop edi 0x00000019 mov dword ptr [esp+04h], edi 0x0000001d add dword ptr [esp+04h], 0000001Dh 0x00000025 inc edi 0x00000026 push edi 0x00000027 ret 0x00000028 pop edi 0x00000029 ret 0x0000002a mov dword ptr [ebp+122D2512h], esi 0x00000030 mov di, 4B77h 0x00000034 push 00000003h 0x00000036 call 00007FF7A105DEACh 0x0000003b push edi 0x0000003c pop edx 0x0000003d pop edi 0x0000003e push 00000000h 0x00000040 mov ecx, 038FFE98h 0x00000045 push 00000003h 0x00000047 jmp 00007FF7A105DEB5h 0x0000004c push A3C808ABh 0x00000051 push eax 0x00000052 push edx 0x00000053 jmp 00007FF7A105DEB4h 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72D6F3 second address: 72D6F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72D6F9 second address: 72D6FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72D6FD second address: 72D74E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor dword ptr [esp], 63C808ABh 0x0000000f or dword ptr [ebp+122D2669h], eax 0x00000015 lea ebx, dword ptr [ebp+1244D201h] 0x0000001b push 00000000h 0x0000001d push eax 0x0000001e call 00007FF7A0B38028h 0x00000023 pop eax 0x00000024 mov dword ptr [esp+04h], eax 0x00000028 add dword ptr [esp+04h], 00000014h 0x00000030 inc eax 0x00000031 push eax 0x00000032 ret 0x00000033 pop eax 0x00000034 ret 0x00000035 call 00007FF7A0B3802Dh 0x0000003a mov edi, dword ptr [ebp+122D3AB3h] 0x00000040 pop esi 0x00000041 xchg eax, ebx 0x00000042 push eax 0x00000043 push edx 0x00000044 push esi 0x00000045 push eax 0x00000046 push edx 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72D74E second address: 72D753 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74A19A second address: 74A1B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF7A0B38037h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74A1B7 second address: 74A1BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74A1BB second address: 74A1C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74A1C5 second address: 74A1CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FF7A105DEA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74A34D second address: 74A359 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FF7A0B38026h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74A4B1 second address: 74A4B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74A606 second address: 74A61B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7A0B3802Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74A61B second address: 74A621 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74A621 second address: 74A627 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74A777 second address: 74A77B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74A77B second address: 74A787 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74A787 second address: 74A79A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF7A105DEAEh 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74A905 second address: 74A909 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74A909 second address: 74A930 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b jmp 00007FF7A105DEACh 0x00000010 jnc 00007FF7A105DEA6h 0x00000016 popad 0x00000017 pushad 0x00000018 jg 00007FF7A105DEA6h 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74A930 second address: 74A94B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF7A0B38036h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74A94B second address: 74A952 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74AD85 second address: 74AD8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71FC82 second address: 71FC86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71FC86 second address: 71FCA8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7A0B3802Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a jmp 00007FF7A0B3802Fh 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71FCA8 second address: 71FCAF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74B2A2 second address: 74B2B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FF7A0B38026h 0x0000000a popad 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74B2B0 second address: 74B2B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74B8B2 second address: 74B8B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74B8B6 second address: 74B8CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FF7A105DEA6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jg 00007FF7A105DEA6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74B8CA second address: 74B8D2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74B8D2 second address: 74B8D9 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 752E7C second address: 752E81 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 752E81 second address: 752EC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jmp 00007FF7A105DEADh 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 pushad 0x00000012 jmp 00007FF7A105DEB5h 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FF7A105DEB2h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 752EC4 second address: 752EFB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7A0B38034h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov eax, dword ptr [eax] 0x0000000c jng 00007FF7A0B38030h 0x00000012 pushad 0x00000013 jnl 00007FF7A0B38026h 0x00000019 pushad 0x0000001a popad 0x0000001b popad 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 push edi 0x00000024 pop edi 0x00000025 pushad 0x00000026 popad 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75908A second address: 75908F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 759457 second address: 75945D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75945D second address: 759471 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jno 00007FF7A105DEA6h 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 push esi 0x00000011 pop esi 0x00000012 push edx 0x00000013 pop edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75977B second address: 759785 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FF7A0B38026h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 759A0F second address: 759A50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 jmp 00007FF7A105DEB7h 0x0000000a push edi 0x0000000b pop edi 0x0000000c pop esi 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 jne 00007FF7A105DEA6h 0x00000018 popad 0x00000019 jns 00007FF7A105DEB6h 0x0000001f jmp 00007FF7A105DEAAh 0x00000024 je 00007FF7A105DEA6h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75A336 second address: 75A33C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75A33C second address: 75A340 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75A38E second address: 75A394 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75A394 second address: 75A399 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75A6C2 second address: 75A6C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75AFF2 second address: 75B044 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FF7A105DEBEh 0x00000008 jmp 00007FF7A105DEB8h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 pushad 0x00000011 push edi 0x00000012 jmp 00007FF7A105DEB3h 0x00000017 pop edi 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FF7A105DEB7h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75B044 second address: 75B048 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75B110 second address: 75B132 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FF7A105DEACh 0x00000008 jg 00007FF7A105DEA6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push ecx 0x00000014 jmp 00007FF7A105DEADh 0x00000019 pop ecx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75B132 second address: 75B137 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75B1E2 second address: 75B1E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75B2D6 second address: 75B2E4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007FF7A0B3802Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75B65D second address: 75B661 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75E2AF second address: 75E2B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75E2B3 second address: 75E2F9 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FF7A105DEA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d mov esi, dword ptr [ebp+122D29DFh] 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push ecx 0x00000018 xor edi, dword ptr [ebp+12448448h] 0x0000001e pop edi 0x0000001f push esi 0x00000020 sbb si, 5884h 0x00000025 pop esi 0x00000026 xchg eax, ebx 0x00000027 pushad 0x00000028 jng 00007FF7A105DEACh 0x0000002e jmp 00007FF7A105DEAAh 0x00000033 popad 0x00000034 push eax 0x00000035 push eax 0x00000036 push edx 0x00000037 push eax 0x00000038 push ecx 0x00000039 pop ecx 0x0000003a pop eax 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75ECC5 second address: 75ECC9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75ECC9 second address: 75ECD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007FF7A105DEACh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 760E15 second address: 760E8C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jnp 00007FF7A0B38026h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 jo 00007FF7A0B38028h 0x00000016 push edi 0x00000017 pop edi 0x00000018 jmp 00007FF7A0B3802Fh 0x0000001d popad 0x0000001e nop 0x0000001f push 00000000h 0x00000021 push ebx 0x00000022 call 00007FF7A0B38028h 0x00000027 pop ebx 0x00000028 mov dword ptr [esp+04h], ebx 0x0000002c add dword ptr [esp+04h], 00000018h 0x00000034 inc ebx 0x00000035 push ebx 0x00000036 ret 0x00000037 pop ebx 0x00000038 ret 0x00000039 jmp 00007FF7A0B38030h 0x0000003e or di, 5A0Eh 0x00000043 push 00000000h 0x00000045 movsx esi, di 0x00000048 mov dword ptr [ebp+1244CA70h], ecx 0x0000004e push 00000000h 0x00000050 mov esi, dword ptr [ebp+122D2812h] 0x00000056 push eax 0x00000057 push ecx 0x00000058 push eax 0x00000059 push edx 0x0000005a push eax 0x0000005b push edx 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 760E8C second address: 760E90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7615BB second address: 7615CC instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FF7A0B38028h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 767085 second address: 767089 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 767FD7 second address: 767FDB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 767FDB second address: 768068 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push edi 0x0000000d call 00007FF7A105DEA8h 0x00000012 pop edi 0x00000013 mov dword ptr [esp+04h], edi 0x00000017 add dword ptr [esp+04h], 00000016h 0x0000001f inc edi 0x00000020 push edi 0x00000021 ret 0x00000022 pop edi 0x00000023 ret 0x00000024 call 00007FF7A105DEB1h 0x00000029 adc bx, 8C16h 0x0000002e pop ebx 0x0000002f push 00000000h 0x00000031 mov di, 6B66h 0x00000035 push 00000000h 0x00000037 push 00000000h 0x00000039 push edx 0x0000003a call 00007FF7A105DEA8h 0x0000003f pop edx 0x00000040 mov dword ptr [esp+04h], edx 0x00000044 add dword ptr [esp+04h], 00000014h 0x0000004c inc edx 0x0000004d push edx 0x0000004e ret 0x0000004f pop edx 0x00000050 ret 0x00000051 pushad 0x00000052 jmp 00007FF7A105DEB2h 0x00000057 mov ah, dh 0x00000059 popad 0x0000005a xchg eax, esi 0x0000005b push eax 0x0000005c push edx 0x0000005d push eax 0x0000005e jmp 00007FF7A105DEAFh 0x00000063 pop eax 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 768068 second address: 768088 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7A0B38030h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jnl 00007FF7A0B38026h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 768088 second address: 76808D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76A2A8 second address: 76A2AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76DF21 second address: 76DF43 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7A105DEB3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jng 00007FF7A105DEA6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76DF43 second address: 76DF4D instructions: 0x00000000 rdtsc 0x00000002 jo 00007FF7A0B38026h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76BFC2 second address: 76BFD3 instructions: 0x00000000 rdtsc 0x00000002 je 00007FF7A105DEA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76BFD3 second address: 76BFED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF7A0B38035h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 770F83 second address: 770FAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FF7A105DEA6h 0x0000000a popad 0x0000000b pop ebx 0x0000000c push eax 0x0000000d pushad 0x0000000e pushad 0x0000000f jmp 00007FF7A105DEAEh 0x00000014 jns 00007FF7A105DEA6h 0x0000001a popad 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76BFED second address: 76BFF2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 770FAA second address: 77100B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 nop 0x00000009 mov edi, esi 0x0000000b push 00000000h 0x0000000d push 00000000h 0x0000000f push esi 0x00000010 call 00007FF7A105DEA8h 0x00000015 pop esi 0x00000016 mov dword ptr [esp+04h], esi 0x0000001a add dword ptr [esp+04h], 00000019h 0x00000022 inc esi 0x00000023 push esi 0x00000024 ret 0x00000025 pop esi 0x00000026 ret 0x00000027 push 00000000h 0x00000029 push 00000000h 0x0000002b push eax 0x0000002c call 00007FF7A105DEA8h 0x00000031 pop eax 0x00000032 mov dword ptr [esp+04h], eax 0x00000036 add dword ptr [esp+04h], 00000014h 0x0000003e inc eax 0x0000003f push eax 0x00000040 ret 0x00000041 pop eax 0x00000042 ret 0x00000043 and edi, 421621AAh 0x00000049 xchg eax, esi 0x0000004a push edi 0x0000004b push eax 0x0000004c push edx 0x0000004d jmp 00007FF7A105DEABh 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77100B second address: 771034 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7A0B38039h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jns 00007FF7A0B38028h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7703C2 second address: 7703E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007FF7A105DEABh 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FF7A105DEAAh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76F3A7 second address: 76F3AC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 772029 second address: 77202D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77202D second address: 772033 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77117B second address: 771180 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7721D6 second address: 7721E4 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007FF7A0B3802Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7732DC second address: 7732E6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7732E6 second address: 7732EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7732EA second address: 7733A9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7A105DEB1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d call 00007FF7A105DEB3h 0x00000012 js 00007FF7A105DEABh 0x00000018 sbb bx, 6B58h 0x0000001d pop ebx 0x0000001e push dword ptr fs:[00000000h] 0x00000025 push 00000000h 0x00000027 push ebp 0x00000028 call 00007FF7A105DEA8h 0x0000002d pop ebp 0x0000002e mov dword ptr [esp+04h], ebp 0x00000032 add dword ptr [esp+04h], 0000001Bh 0x0000003a inc ebp 0x0000003b push ebp 0x0000003c ret 0x0000003d pop ebp 0x0000003e ret 0x0000003f mov dword ptr [ebp+122D1DEAh], ecx 0x00000045 call 00007FF7A105DEAEh 0x0000004a mov bx, ax 0x0000004d pop edi 0x0000004e mov dword ptr fs:[00000000h], esp 0x00000055 ja 00007FF7A105DEACh 0x0000005b mov eax, dword ptr [ebp+122D02B9h] 0x00000061 push 00000000h 0x00000063 push edi 0x00000064 call 00007FF7A105DEA8h 0x00000069 pop edi 0x0000006a mov dword ptr [esp+04h], edi 0x0000006e add dword ptr [esp+04h], 00000016h 0x00000076 inc edi 0x00000077 push edi 0x00000078 ret 0x00000079 pop edi 0x0000007a ret 0x0000007b push FFFFFFFFh 0x0000007d mov bl, B4h 0x0000007f or di, 99B8h 0x00000084 push eax 0x00000085 push ebx 0x00000086 push edx 0x00000087 push eax 0x00000088 push edx 0x00000089 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78195E second address: 78197A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jng 00007FF7A0B3802Ah 0x0000000f push eax 0x00000010 pushad 0x00000011 popad 0x00000012 pop eax 0x00000013 mov eax, dword ptr [esp+04h] 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a push ebx 0x0000001b pop ebx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78197A second address: 7819BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7A105DEB6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a mov eax, dword ptr [eax] 0x0000000c push edi 0x0000000d pushad 0x0000000e jmp 00007FF7A105DEB5h 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 pop edi 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b push ecx 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7819BB second address: 7819BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 787430 second address: 787437 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 787437 second address: 78744C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 pushad 0x00000007 jns 00007FF7A0B38026h 0x0000000d jnp 00007FF7A0B38026h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78744C second address: 787461 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 jmp 00007FF7A105DEADh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 787461 second address: 787469 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7860C7 second address: 7860CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7866B5 second address: 7866D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF7A0B38037h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78684C second address: 786871 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FF7A105DEA8h 0x00000008 ja 00007FF7A105DEBFh 0x0000000e jmp 00007FF7A105DEB3h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 786CEF second address: 786D24 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007FF7A0B38032h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jbe 00007FF7A0B3802Ah 0x00000014 jmp 00007FF7A0B38030h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 786E70 second address: 786E79 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 786E79 second address: 786E7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 786E7F second address: 786E84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 786E84 second address: 786E91 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 jnl 00007FF7A0B38026h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 789EAC second address: 789EBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jng 00007FF7A105DEA6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 789EBB second address: 789EBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 789EBF second address: 789EC3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 789EC3 second address: 789EC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7932DB second address: 7932F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FF7A105DEACh 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jo 00007FF7A105DEA6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 791DA5 second address: 791DAF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 791DAF second address: 791DB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79217F second address: 79218C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jc 00007FF7A0B3802Eh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7927FA second address: 792803 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push edi 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 792803 second address: 792820 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FF7A0B38034h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 792820 second address: 79282A instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FF7A105DEA6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 792AFC second address: 792B2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF7A0B38036h 0x00000009 pushad 0x0000000a jmp 00007FF7A0B3802Dh 0x0000000f jnl 00007FF7A0B38026h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 792C71 second address: 792C7E instructions: 0x00000000 rdtsc 0x00000002 jl 00007FF7A105DEA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 792C7E second address: 792C8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop esi 0x00000006 push edi 0x00000007 je 00007FF7A0B3802Eh 0x0000000d push edi 0x0000000e pop edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 792C8F second address: 792C98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 793144 second address: 793148 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7979AE second address: 7979B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7979B4 second address: 7979B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 724CF5 second address: 724D11 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF7A105DEABh 0x00000008 jng 00007FF7A105DEA6h 0x0000000e je 00007FF7A105DEA6h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 761EAD second address: 761EB2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 761EB2 second address: 761EB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 761EB8 second address: 761EFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a jng 00007FF7A0B38029h 0x00000010 movzx edi, si 0x00000013 lea eax, dword ptr [ebp+12481C17h] 0x00000019 push 00000000h 0x0000001b push ecx 0x0000001c call 00007FF7A0B38028h 0x00000021 pop ecx 0x00000022 mov dword ptr [esp+04h], ecx 0x00000026 add dword ptr [esp+04h], 00000016h 0x0000002e inc ecx 0x0000002f push ecx 0x00000030 ret 0x00000031 pop ecx 0x00000032 ret 0x00000033 cld 0x00000034 push eax 0x00000035 jc 00007FF7A0B38044h 0x0000003b push eax 0x0000003c push edx 0x0000003d je 00007FF7A0B38026h 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 761EFF second address: 743A69 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7A105DEB2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push ebx 0x0000000f call 00007FF7A105DEA8h 0x00000014 pop ebx 0x00000015 mov dword ptr [esp+04h], ebx 0x00000019 add dword ptr [esp+04h], 00000015h 0x00000021 inc ebx 0x00000022 push ebx 0x00000023 ret 0x00000024 pop ebx 0x00000025 ret 0x00000026 mov dword ptr [ebp+1244D096h], esi 0x0000002c mov dword ptr [ebp+1244A4BFh], edx 0x00000032 call dword ptr [ebp+12449644h] 0x00000038 pushad 0x00000039 jp 00007FF7A105DEA8h 0x0000003f jp 00007FF7A105DEB5h 0x00000045 jmp 00007FF7A105DEB9h 0x0000004a popad 0x0000004b push eax 0x0000004c push edx 0x0000004d jmp 00007FF7A105DEB3h 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 762018 second address: 7620B9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 pushad 0x00000008 popad 0x00000009 pop edi 0x0000000a popad 0x0000000b xchg eax, ebx 0x0000000c sub edi, 5361EE11h 0x00000012 mov cx, bx 0x00000015 push dword ptr fs:[00000000h] 0x0000001c mov dword ptr fs:[00000000h], esp 0x00000023 mov cl, 65h 0x00000025 call 00007FF7A0B38039h 0x0000002a or edi, dword ptr [ebp+122D3B9Bh] 0x00000030 pop ecx 0x00000031 mov dword ptr [ebp+12481C6Fh], esp 0x00000037 push ecx 0x00000038 xor dword ptr [ebp+1246D091h], ecx 0x0000003e pop edx 0x0000003f cmp dword ptr [ebp+122D3BC7h], 00000000h 0x00000046 jne 00007FF7A0B38133h 0x0000004c jno 00007FF7A0B3802Ch 0x00000052 mov byte ptr [ebp+122D286Ch], 00000047h 0x00000059 mov edx, dword ptr [ebp+122D287Ah] 0x0000005f mov eax, D49AA7D2h 0x00000064 mov dword ptr [ebp+122D1D1Dh], esi 0x0000006a nop 0x0000006b push eax 0x0000006c push edx 0x0000006d push eax 0x0000006e push edx 0x0000006f jmp 00007FF7A0B38038h 0x00000074 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7620B9 second address: 7620C3 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FF7A105DEA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 762450 second address: 762455 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 762455 second address: 76245A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76245A second address: 762474 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jo 00007FF7A0B38030h 0x00000010 jmp 00007FF7A0B3802Ah 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 762474 second address: 76247F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007FF7A105DEA6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76247F second address: 5B3EF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 jmp 00007FF7A0B38035h 0x0000000d push dword ptr [ebp+122D0D21h] 0x00000013 mov edx, 2C82F50Fh 0x00000018 call dword ptr [ebp+122D24CFh] 0x0000001e pushad 0x0000001f jmp 00007FF7A0B38034h 0x00000024 xor eax, eax 0x00000026 pushad 0x00000027 adc esi, 6AE61E96h 0x0000002d mov edi, dword ptr [ebp+122D3C8Fh] 0x00000033 popad 0x00000034 mov edx, dword ptr [esp+28h] 0x00000038 pushad 0x00000039 mov ecx, dword ptr [ebp+122D3C7Fh] 0x0000003f jmp 00007FF7A0B3802Eh 0x00000044 popad 0x00000045 pushad 0x00000046 movsx ecx, dx 0x00000049 popad 0x0000004a mov dword ptr [ebp+122D3B33h], eax 0x00000050 mov dword ptr [ebp+122D1D1Dh], edx 0x00000056 mov esi, 0000003Ch 0x0000005b stc 0x0000005c add esi, dword ptr [esp+24h] 0x00000060 jng 00007FF7A0B3802Ch 0x00000066 sub dword ptr [ebp+122D1D1Dh], eax 0x0000006c lodsw 0x0000006e pushad 0x0000006f mov dh, 17h 0x00000071 mov esi, dword ptr [ebp+122D3D3Fh] 0x00000077 popad 0x00000078 add eax, dword ptr [esp+24h] 0x0000007c jmp 00007FF7A0B38031h 0x00000081 mov ebx, dword ptr [esp+24h] 0x00000085 jmp 00007FF7A0B38036h 0x0000008a push eax 0x0000008b push eax 0x0000008c push edx 0x0000008d jnp 00007FF7A0B3803Ah 0x00000093 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7624E8 second address: 762502 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7A105DEB6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 762502 second address: 76252D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7A0B38031h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 7641F7BBh 0x00000010 push C26B1E07h 0x00000015 push eax 0x00000016 push edx 0x00000017 jnc 00007FF7A0B3802Ch 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76252D second address: 762531 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 762531 second address: 762537 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 762537 second address: 76253B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76266A second address: 7626A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], esi 0x00000009 push 00000000h 0x0000000b push edx 0x0000000c call 00007FF7A0B38028h 0x00000011 pop edx 0x00000012 mov dword ptr [esp+04h], edx 0x00000016 add dword ptr [esp+04h], 0000001Ch 0x0000001e inc edx 0x0000001f push edx 0x00000020 ret 0x00000021 pop edx 0x00000022 ret 0x00000023 push eax 0x00000024 push eax 0x00000025 push edx 0x00000026 jnp 00007FF7A0B3802Ch 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76287A second address: 7628AA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7A105DEB9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c jns 00007FF7A105DEA8h 0x00000012 push eax 0x00000013 push edx 0x00000014 jbe 00007FF7A105DEA6h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 762DBC second address: 762DC2 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 762DC2 second address: 762DDA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007FF7A105DEA6h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 ja 00007FF7A105DEA6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 762DDA second address: 762DDE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 763068 second address: 76306D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76306D second address: 763073 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 763104 second address: 763124 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7A105DEB0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jg 00007FF7A105DEA6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 763124 second address: 76312A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76312A second address: 76312F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79717F second address: 797196 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 ja 00007FF7A0B3802Ah 0x0000000b push eax 0x0000000c push edx 0x0000000d jnl 00007FF7A0B38026h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 797352 second address: 797386 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FF7A105DEA6h 0x00000008 jmp 00007FF7A105DEAAh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jno 00007FF7A105DEA6h 0x00000017 jmp 00007FF7A105DEB8h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 797386 second address: 79738A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79738A second address: 797390 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7974DA second address: 797513 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jng 00007FF7A0B38043h 0x0000000c pop esi 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 jns 00007FF7A0B38026h 0x00000016 jnc 00007FF7A0B38026h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 797513 second address: 797541 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007FF7A105DEB2h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FF7A105DEB0h 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 797541 second address: 797545 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79D7D1 second address: 79D7D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79D7D6 second address: 79D7DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79CA36 second address: 79CA69 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FF7A105DEB4h 0x0000000b jne 00007FF7A105DEB4h 0x00000011 jmp 00007FF7A105DEACh 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 popad 0x00000019 pushad 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79CE8A second address: 79CE91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79CFE1 second address: 79D041 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7A105DEB3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FF7A105DEB8h 0x0000000e push edx 0x0000000f jmp 00007FF7A105DEADh 0x00000014 jno 00007FF7A105DEA6h 0x0000001a pop edx 0x0000001b push eax 0x0000001c jc 00007FF7A105DEA6h 0x00000022 pop eax 0x00000023 popad 0x00000024 push ecx 0x00000025 push edx 0x00000026 jmp 00007FF7A105DEABh 0x0000002b push ecx 0x0000002c pop ecx 0x0000002d pop edx 0x0000002e push esi 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79D1B2 second address: 79D1B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79D1B6 second address: 79D1D3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7A105DEAFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jc 00007FF7A105DEA6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79D1D3 second address: 79D1DD instructions: 0x00000000 rdtsc 0x00000002 jns 00007FF7A0B38026h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79D1DD second address: 79D1EB instructions: 0x00000000 rdtsc 0x00000002 jo 00007FF7A105DEA8h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79D4D1 second address: 79D4D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79D4D5 second address: 79D4D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79D4D9 second address: 79D4E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79D4E1 second address: 79D4EF instructions: 0x00000000 rdtsc 0x00000002 jne 00007FF7A105DEA8h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79D4EF second address: 79D4F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79D4F5 second address: 79D4F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A04D9 second address: 7A04DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A28DF second address: 7A28E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A28E5 second address: 7A2906 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FF7A0B3802Ch 0x0000000c jp 00007FF7A0B38026h 0x00000012 jo 00007FF7A0B38026h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A23B8 second address: 7A23BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A7643 second address: 7A7653 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FF7A0B38026h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b pushad 0x0000000c push esi 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A790C second address: 7A7912 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A7912 second address: 7A7918 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A7918 second address: 7A7929 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b jo 00007FF7A105DEA6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AA3C2 second address: 7AA3C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AA952 second address: 7AA966 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7A105DEB0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B00A1 second address: 7B00A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B00A5 second address: 7B00AE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B00AE second address: 7B00B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FF7A0B38026h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B00B9 second address: 7B00C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 jne 00007FF7A105DEA6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B00C5 second address: 7B00DC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7A0B38033h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AE971 second address: 7AE977 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AE977 second address: 7AE982 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AE982 second address: 7AE986 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AE986 second address: 7AE98C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AE98C second address: 7AE992 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AE992 second address: 7AE9B9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jmp 00007FF7A0B38035h 0x0000000a jns 00007FF7A0B38026h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AEC8A second address: 7AEC8F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AEDDC second address: 7AEE10 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7A0B38030h 0x00000007 pushad 0x00000008 jnp 00007FF7A0B38026h 0x0000000e js 00007FF7A0B38026h 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 pushad 0x0000001a jns 00007FF7A0B3802Ch 0x00000020 push edi 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 762BEC second address: 762C35 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7A105DEB9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push ecx 0x0000000d call 00007FF7A105DEA8h 0x00000012 pop ecx 0x00000013 mov dword ptr [esp+04h], ecx 0x00000017 add dword ptr [esp+04h], 00000017h 0x0000001f inc ecx 0x00000020 push ecx 0x00000021 ret 0x00000022 pop ecx 0x00000023 ret 0x00000024 push 00000004h 0x00000026 mov cx, 25F0h 0x0000002a nop 0x0000002b pushad 0x0000002c push eax 0x0000002d push edx 0x0000002e push esi 0x0000002f pop esi 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 762C35 second address: 762C4F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7A0B38032h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 762C4F second address: 762C60 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FF7A105DEA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push esi 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AF352 second address: 7AF375 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FF7A0B3802Eh 0x00000008 jo 00007FF7A0B3802Ch 0x0000000e jnc 00007FF7A0B38026h 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push esi 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AF375 second address: 7AF379 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B16AE second address: 7B16B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71AC9B second address: 71ACA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71ACA1 second address: 71ACA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71ACA9 second address: 71ACD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FF7A105DEB2h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FF7A105DEB2h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71ACD5 second address: 71ACDC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B71B8 second address: 7B71BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B71BE second address: 7B71CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FF7A0B3802Ch 0x0000000a jg 00007FF7A0B38026h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B7472 second address: 7B747D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007FF7A105DEA6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B747D second address: 7B749D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 je 00007FF7A0B38032h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B7713 second address: 7B7767 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FF7A105DEB9h 0x0000000d pushad 0x0000000e jmp 00007FF7A105DEB8h 0x00000013 jmp 00007FF7A105DEB8h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B7DBD second address: 7B7DC7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007FF7A0B38026h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B838C second address: 7B8392 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B8392 second address: 7B83D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jng 00007FF7A0B38026h 0x0000000c popad 0x0000000d jno 00007FF7A0B38028h 0x00000013 jbe 00007FF7A0B3805Fh 0x00000019 pushad 0x0000001a jnc 00007FF7A0B38026h 0x00000020 jl 00007FF7A0B38026h 0x00000026 push edx 0x00000027 pop edx 0x00000028 popad 0x00000029 push eax 0x0000002a push edx 0x0000002b jp 00007FF7A0B38026h 0x00000031 jmp 00007FF7A0B38031h 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B83D6 second address: 7B83E0 instructions: 0x00000000 rdtsc 0x00000002 js 00007FF7A105DEA6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BCEE9 second address: 7BCEEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BC1FB second address: 7BC238 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FF7A105DEA6h 0x0000000a pop eax 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f jmp 00007FF7A105DEB7h 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 pop eax 0x00000017 jmp 00007FF7A105DEB4h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BC381 second address: 7BC3E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jc 00007FF7A0B3802Ch 0x0000000d jne 00007FF7A0B38038h 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 jmp 00007FF7A0B38035h 0x0000001b pushad 0x0000001c popad 0x0000001d popad 0x0000001e popad 0x0000001f pushad 0x00000020 push ecx 0x00000021 pushad 0x00000022 popad 0x00000023 jmp 00007FF7A0B38030h 0x00000028 pop ecx 0x00000029 push eax 0x0000002a push edx 0x0000002b jnc 00007FF7A0B38026h 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BC53E second address: 7BC542 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BC542 second address: 7BC54B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BC54B second address: 7BC557 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FF7A105DEA6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BC557 second address: 7BC55C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BC6AA second address: 7BC6BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FF7A105DEA6h 0x0000000a pop edi 0x0000000b push eax 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BC7FF second address: 7BC805 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BC805 second address: 7BC809 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BC809 second address: 7BC82F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007FF7A0B38036h 0x0000000e jp 00007FF7A0B3802Ch 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C93DE second address: 7C93E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C74BC second address: 7C74D4 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jl 00007FF7A0B38026h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jl 00007FF7A0B3802Eh 0x00000014 push edi 0x00000015 pop edi 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C74D4 second address: 7C74D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C74D8 second address: 7C74E1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push esi 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C765F second address: 7C7663 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C7663 second address: 7C7667 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C7BA9 second address: 7C7BB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007FF7A105DEA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C7BB3 second address: 7C7BB7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C7E91 second address: 7C7E95 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C7E95 second address: 7C7F02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FF7A0B38026h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007FF7A0B38035h 0x00000012 jc 00007FF7A0B38026h 0x00000018 jmp 00007FF7A0B38034h 0x0000001d jbe 00007FF7A0B38026h 0x00000023 popad 0x00000024 pop esi 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 push eax 0x00000029 pop eax 0x0000002a push ebx 0x0000002b pop ebx 0x0000002c popad 0x0000002d jo 00007FF7A0B38041h 0x00000033 pushad 0x00000034 popad 0x00000035 jmp 00007FF7A0B38039h 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C8060 second address: 7C8068 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C8068 second address: 7C808E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7A0B3802Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b jmp 00007FF7A0B38036h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C808E second address: 7C80A4 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FF7A105DEA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e js 00007FF7A105DEA8h 0x00000014 push edx 0x00000015 pop edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C925B second address: 7C927D instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FF7A0B38044h 0x00000008 jmp 00007FF7A0B38038h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DB71E second address: 7DB729 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007FF7A105DEA6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72328D second address: 723293 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DFB80 second address: 7DFBAF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7A105DEB3h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FF7A105DEB6h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EF58B second address: 7EF59C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a jno 00007FF7A0B38026h 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EF59C second address: 7EF5A7 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jbe 00007FF7A105DEA6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EF5A7 second address: 7EF5C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FF7A0B38030h 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F16BC second address: 7F16C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F16C3 second address: 7F16CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007FF7A0B38026h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F16CF second address: 7F16F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FF7A105DEB7h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F361E second address: 7F362B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 je 00007FF7A0B38032h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F362B second address: 7F3631 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FBDAA second address: 7FBDB0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FBDB0 second address: 7FBDB7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FC016 second address: 7FC025 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FC025 second address: 7FC04B instructions: 0x00000000 rdtsc 0x00000002 jg 00007FF7A105DEA6h 0x00000008 jbe 00007FF7A105DEA6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jmp 00007FF7A105DEB6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FC04B second address: 7FC070 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF7A0B38034h 0x00000009 jmp 00007FF7A0B3802Dh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FC070 second address: 7FC074 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FC20C second address: 7FC212 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FC212 second address: 7FC217 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FC392 second address: 7FC39E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 ja 00007FF7A0B38026h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FC6E1 second address: 7FC6FC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7A105DEB5h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FC6FC second address: 7FC708 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007FF7A0B38026h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FC708 second address: 7FC70C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FC70C second address: 7FC710 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FC710 second address: 7FC71A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FC71A second address: 7FC71E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FD1B5 second address: 7FD1BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FD1BB second address: 7FD1CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FD1CA second address: 7FD1D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FFCA0 second address: 7FFCEE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7A0B38037h 0x00000007 jno 00007FF7A0B38026h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jmp 00007FF7A0B3802Dh 0x00000015 push ebx 0x00000016 pop ebx 0x00000017 jmp 00007FF7A0B38039h 0x0000001c popad 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FFCEE second address: 7FFD11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF7A105DEB5h 0x00000009 pop edx 0x0000000a popad 0x0000000b pushad 0x0000000c push ecx 0x0000000d push eax 0x0000000e pop eax 0x0000000f pop ecx 0x00000010 push edi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FFE85 second address: 7FFE89 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80AED7 second address: 80AEDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80AEDD second address: 80AEFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007FF7A0B38034h 0x0000000c pop edi 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80AEFE second address: 80AF04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80AF04 second address: 80AF08 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80AF08 second address: 80AF11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80AF11 second address: 80AF24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FF7A0B38026h 0x0000000a pop edi 0x0000000b jbe 00007FF7A0B3802Eh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 811350 second address: 811366 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF7A105DEB1h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 815011 second address: 815042 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7A0B3802Ah 0x00000007 pushad 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push edi 0x0000000b pop edi 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FF7A0B3802Fh 0x00000016 jmp 00007FF7A0B3802Ch 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 815042 second address: 815057 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF7A105DEABh 0x00000009 jnp 00007FF7A105DEA6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 815057 second address: 81505D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 821F91 second address: 821FAA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7A105DEAFh 0x00000007 jne 00007FF7A105DEA6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83A5D5 second address: 83A5DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83A5DB second address: 83A60F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7A105DEB6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jnc 00007FF7A105DEB6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83A60F second address: 83A614 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83A777 second address: 83A786 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jg 00007FF7A105DEA6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83A786 second address: 83A7C9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7A0B3802Bh 0x00000007 jo 00007FF7A0B38026h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 push edx 0x00000016 pop edx 0x00000017 push ecx 0x00000018 pop ecx 0x00000019 jmp 00007FF7A0B3802Eh 0x0000001e popad 0x0000001f push eax 0x00000020 push edx 0x00000021 push edx 0x00000022 pop edx 0x00000023 jmp 00007FF7A0B38031h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83A7C9 second address: 83A7D3 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FF7A105DEA6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83A7D3 second address: 83A7D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83A97F second address: 83A985 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83A985 second address: 83A996 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jnc 00007FF7A0B3802Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83A996 second address: 83A99D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83AF82 second address: 83AF8C instructions: 0x00000000 rdtsc 0x00000002 ja 00007FF7A0B3802Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83AF8C second address: 83AF96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83CDEB second address: 83CE19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007FF7A0B38036h 0x0000000d jmp 00007FF7A0B3802Eh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83F915 second address: 83F990 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7A105DEB5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a jmp 00007FF7A105DEAEh 0x0000000f pop edi 0x00000010 popad 0x00000011 push eax 0x00000012 jmp 00007FF7A105DEB2h 0x00000017 nop 0x00000018 mov dh, E9h 0x0000001a push 00000004h 0x0000001c movsx edx, dx 0x0000001f call 00007FF7A105DEA9h 0x00000024 pushad 0x00000025 pushad 0x00000026 jns 00007FF7A105DEA6h 0x0000002c jmp 00007FF7A105DEB3h 0x00000031 popad 0x00000032 push eax 0x00000033 push edx 0x00000034 jmp 00007FF7A105DEAFh 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 841379 second address: 84138E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7A0B3802Bh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84138E second address: 841392 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 841392 second address: 8413AF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7A0B38039h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8413AF second address: 8413CE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7A105DEB5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8413CE second address: 8413D6 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80D4D second address: 4A80D5D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF7A105DEACh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80D5D second address: 4A80DB7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ecx, dword ptr [eax+00000FDCh] 0x0000000e jmp 00007FF7A0B38037h 0x00000013 test ecx, ecx 0x00000015 pushad 0x00000016 jmp 00007FF7A0B38034h 0x0000001b mov dx, ax 0x0000001e popad 0x0000001f jns 00007FF7A0B3805Bh 0x00000025 jmp 00007FF7A0B3802Ch 0x0000002a add eax, ecx 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 pushad 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80DB7 second address: 4A80DBB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80DBB second address: 4A80DC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80DC1 second address: 4A80DD0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF7A105DEABh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80DD0 second address: 4A80E07 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax+00000860h] 0x0000000e pushad 0x0000000f mov si, di 0x00000012 mov edx, 31FE5A72h 0x00000017 popad 0x00000018 test eax, eax 0x0000001a pushad 0x0000001b mov dx, C5CAh 0x0000001f jmp 00007FF7A0B3802Bh 0x00000024 popad 0x00000025 je 00007FF811CADF8Ah 0x0000002b push eax 0x0000002c push edx 0x0000002d push eax 0x0000002e push edx 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80E07 second address: 4A80E0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80E0B second address: 4A80E0F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80E0F second address: 4A80E15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75D129 second address: 75D133 instructions: 0x00000000 rdtsc 0x00000002 je 00007FF7A0B3802Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 5B3F5D instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 5B3E83 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 7D53F2 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe TID: 6720

Thread sleep time: -90000s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: file.exe, file.exe, 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000003.1702917421.0000000000CBA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694741062.0000000000CBA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1707016572.0000000000CBA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000003.1702917421.0000000000CA8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694741062.0000000000CA8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1707016572.0000000000CA8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWL
Source: file.exe, 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: file.exe, 00000000.00000002.1706972761.0000000000C2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00595BB0 LdrInitializeThunk,

0_2_00595BB0

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: file.exe	String found in binary or memory: clearancek.site
Source: file.exe	String found in binary or memory: licendfilteo.site
Source: file.exe	String found in binary or memory: spirittunek.stor
Source: file.exe	String found in binary or memory: bathdoomgaz.stor
Source: file.exe	String found in binary or memory: studennotediw.stor
Source: file.exe	String found in binary or memory: dissapoiznw.stor
Source: file.exe	String found in binary or memory: eaglepawnoy.stor
Source: file.exe	String found in binary or memory: mobbipenju.stor

Source: file.exe, 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: ZProgram Manager
Source: file.exe	Binary or memory string: ZProgram Manager

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	24 Virtualization/Sandbox Evasion	OS Credential Dumping	631 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	LSASS Memory	24 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	4 Obfuscated Files or Information	NTDS	223 System Information Discovery	Distributed Component Object Model	Input Capture	115 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://player.vimeo.com	0%	URL Reputation	safe
https://store.steampowered.com/subscriber_agreement/	0%	URL Reputation	safe
https://www.gstatic.cn/recaptcha/	0%	URL Reputation	safe
http://www.valvesoftware.com/legal.htm	0%	URL Reputation	safe
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	0%	URL Reputation	safe
https://steam.tv/	0%	URL Reputation	safe
https://steamcommunity.com:443/profiles/76561199724331900	100%	URL Reputation	malware
https://store.steampowered.com/points/shop/	0%	URL Reputation	safe
https://lv.queniujq.cn	0%	URL Reputation	safe
https://store.steampowered.com/privacy_agreement/	0%	URL Reputation	safe
https://checkout.steampowered.com/	0%	URL Reputation	safe
https://store.steampowered.com/;	0%	URL Reputation	safe
https://store.steampowered.com/about/	0%	URL Reputation	safe
https://help.steampowered.com/en/	0%	URL Reputation	safe
https://store.steampowered.com/news/	0%	URL Reputation	safe
https://recaptcha.net/recaptcha/;	0%	URL Reputation	safe
https://store.steampowered.com/stats/	0%	URL Reputation	safe
https://medal.tv	0%	URL Reputation	safe
https://broadcast.st.dl.eccdnx.com	0%	URL Reputation	safe
https://store.steampowered.com/steam_refunds/	0%	URL Reputation	safe
https://login.steampowered.com/	0%	URL Reputation	safe
https://recaptcha.net	0%	URL Reputation	safe
https://store.steampowered.com/	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
steamcommunity.com	104.102.49.254	true	true	unknown
sergei-esenin.com	104.21.53.8	true	true	unknown
eaglepawnoy.store	unknown	unknown	true	unknown
bathdoomgaz.store	unknown	unknown	true	unknown
spirittunek.store	unknown	unknown	true	unknown
licendfilteo.site	unknown	unknown	true	unknown
studennotediw.store	unknown	unknown	true	unknown
mobbipenju.store	unknown	unknown	true	unknown
clearancek.site	unknown	unknown	true	unknown
dissapoiznw.store	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Reputation
studennotediw.store	true	unknown
dissapoiznw.store	true	unknown
https://steamcommunity.com/profiles/76561199724331900	true	unknown
eaglepawnoy.store	true	unknown
bathdoomgaz.store	true	unknown
clearancek.site	true	unknown
spirittunek.store	true	unknown
licendfilteo.site	true	unknown
mobbipenju.store	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.cloudflare.com/learning/access-management/phishing-attack/	file.exe, 00000000.00000002.1707016572.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694741062.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://player.vimeo.com	file.exe, 00000000.00000003.1694741062.0000000000CBA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C0e3d185a3e106e7	file.exe, 00000000.00000003.1694741062.0000000000CBA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.cloudflare.com/learning/acces	file.exe, 00000000.00000003.1694741062.0000000000CBA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.steamstatic.com/public/javascript/promo/stickers.js?v=W8NP8aTVqtms&l=english	file.exe, 00000000.00000002.1707016572.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694741062.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/?subsection=broadcasts	file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://mobbipenju.store:443/apibcryptPrimitives.dll%	file.exe, 00000000.00000002.1707016572.0000000000C6F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000C6F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.steamstatic.com/public/shared/css/motiva_sans.css?v=v7XTmVzbLV33&l=english	file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694741062.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://sergei-esenin.com/	file.exe, 00000000.00000003.1694741062.0000000000CBA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1707198878.0000000000D0A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.steamstatic.com/public/css/globalv2.css?v=dQy8Omh4p9PH&l=english	file.exe, 00000000.00000002.1707016572.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694741062.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/subscriber_agreement/	file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.gstatic.cn/recaptcha/	file.exe, 00000000.00000003.1694741062.0000000000CBA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.valvesoftware.com/legal.htm	file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.youtube.com	file.exe, 00000000.00000003.1694741062.0000000000CBA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.google.com	file.exe, 00000000.00000003.1694741062.0000000000CBA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0	file.exe, 00000000.00000002.1707016572.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694741062.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.steamsta	file.exe, 00000000.00000003.1703595779.0000000000D0A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1707198878.0000000000D0A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	file.exe, 00000000.00000003.1702540658.0000000000D10000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1	file.exe, 00000000.00000002.1707016572.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694741062.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/	file.exe, 00000000.00000003.1694741062.0000000000CBA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://sergei-esenin.com:443/api~	file.exe, 00000000.00000002.1707016572.0000000000C6F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000C6F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.cloudflare.com/5	file.exe, 00000000.00000003.1702917421.0000000000CBA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1707016572.0000000000CBA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.steamstu	file.exe, 00000000.00000002.1707016572.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694741062.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://s.ytimg.com;	file.exe, 00000000.00000003.1694741062.0000000000CBA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://eaglepawnoy.store:443/apiG	file.exe, 00000000.00000002.1707016572.0000000000C6F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000C6F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steam.tv/	file.exe, 00000000.00000003.1694741062.0000000000CBA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC	file.exe, 00000000.00000002.1707016572.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694741062.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.steamstatic.com/public/css/skin_1/profilev2.css?v=t9xiI4DlPpEB&l=english	file.exe, 00000000.00000002.1707016572.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694741062.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com:443/profiles/76561199724331900	file.exe, 00000000.00000002.1707016572.0000000000C6F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000C6F000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
https://avatars.fastly.steamstatic.com/fef49e7fa7e1997310d705b2a619$e	file.exe, 00000000.00000003.1694741062.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/points/shop/	file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.steamstatic.com/public/javascript/applications/community/main.js?v=4XouecKy8sZy&am	file.exe, 00000000.00000002.1707016572.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694741062.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694741062.0000000000C97000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.steamstatic.com/public/shared/css/sh	file.exe, 00000000.00000002.1707016572.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694741062.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://sketchfab.com	file.exe, 00000000.00000003.1694741062.0000000000CBA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://lv.queniujq.cn	file.exe, 00000000.00000003.1694741062.0000000000CBA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.youtube.com/	file.exe, 00000000.00000003.1694741062.0000000000CBA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.steamstatic.com/public/shared/css/shared_global.css?v=uF6G1wyNU-4c&l=english	file.exe, 00000000.00000002.1707016572.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694741062.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/privacy_agreement/	file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.cloudflare.com/5xx-error-landing	file.exe, 00000000.00000003.1694712578.0000000000D02000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694741062.0000000000CBA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694850677.0000000000C87000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://sergei-esenin.com:443/api	file.exe, 00000000.00000002.1707016572.0000000000C6F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000C6F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.google.com/recaptcha/	file.exe, 00000000.00000003.1694741062.0000000000CBA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://checkout.steampowered.com/	file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw	file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694741062.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/;	file.exe, 00000000.00000003.1694741062.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694741062.0000000000CBA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.steamstatic.com/public/css/promo/summer2017/stickers.css?v=P8gOPraCSjV6&l=engl	file.exe, 00000000.00000002.1707016572.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694741062.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/about/	file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/my/wishlist/	file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL&l=	file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://help.steampowered.com/en/	file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/market/	file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/news/	file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=	file.exe, 00000000.00000002.1707016572.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694741062.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.steamstatic.com/public/javascript/global.js?v=7qlUmHSJhPRN&l=english	file.exe, 00000000.00000002.1707016572.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694741062.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english	file.exe, 00000000.00000002.1707016572.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694741062.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://recaptcha.net/recaptcha/;	file.exe, 00000000.00000003.1694741062.0000000000CBA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.steamstatic.com/public/javascript/applications/community/manifest.js?v=r7a4-LYcQOj	file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694741062.0000000000C97000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://sergei-esenin.com/apiU	file.exe, 00000000.00000003.1694741062.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/discussions/	file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/stats/	file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://medal.tv	file.exe, 00000000.00000003.1694741062.0000000000CBA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://broadcast.st.dl.eccdnx.com	file.exe, 00000000.00000003.1694741062.0000000000CBA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/steam_refunds/	file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.steamstatic.com/public/shared/css/buttons.css?v=-WV9f1LdxEjq&l=english	file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://sergei-esenin.com/5L	file.exe, 00000000.00000003.1703595779.0000000000D0A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1707198878.0000000000D0A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.steamstatic.com/public/javascript/applications/community/libraries~b28b7af69.js?v=	file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694741062.0000000000C97000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900	file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.steamstatic.com/	file.exe, 00000000.00000003.1694741062.0000000000CBA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.steamstatic.com/public/css/applications/community/main.css?v=DVae4t4RZiHA&l=en	file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694741062.0000000000C97000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/workshop/	file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://login.steampowered.com/	file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.steamstatic.com/public/shared/images/responsive/header_logo.png	file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.steam	file.exe, 00000000.00000002.1707016572.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694741062.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.steamstatic.	file.exe, 00000000.00000003.1703595779.0000000000D0A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1707198878.0000000000D0A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.steamstatic.com/public/javascript/profile.js?v=bbs9uq0gqJ-H&l=english	file.exe, 00000000.00000002.1707016572.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694741062.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.steamstatic.com/public/css/skin_1/header.css?v=pTvrRy1pm52p&l=english	file.exe, 00000000.00000002.1707016572.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694741062.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://licendfilteo.site:443/api8	file.exe, 00000000.00000002.1707016572.0000000000C6F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000C6F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://recaptcha.net	file.exe, 00000000.00000003.1694741062.0000000000CBA000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/	file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.steamstatic.com/public/shared/javascript/shared_global.js?v=7glT1n_nkVCs&l=eng	file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://studennotediw.store:443/api	file.exe, 00000000.00000002.1707016572.0000000000C6F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000C6F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://127.0.0.1:27060	file.exe, 00000000.00000003.1694741062.0000000000CBA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://avatars.fastly.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	file.exe, 00000000.00000003.1694741062.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694741062.0000000000C97000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://clearancek.site:443/apif	file.exe, 00000000.00000002.1707016572.0000000000C6F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000C6F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=english	file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://sergei-esenin.com/apiin	file.exe, 00000000.00000003.1703595779.0000000000D0A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1707198878.0000000000D0A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.steamstatic.com/public/javascript/webui/clientcom.js?v=jq1jQyX1843y&l=english	file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1&l=engl	file.exe, 00000000.00000002.1707016572.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694741062.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1702917421.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.steamstatic.com/public/images/skin_1/arrowDn9x5.gif	file.exe, 00000000.00000003.1694712578.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694741062.0000000000C97000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.53.8	sergei-esenin.com	United States		13335	CLOUDFLARENETUS	true
104.102.49.254	steamcommunity.com	United States		16625	AKAMAI-ASUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1538207
Start date and time:	2024-10-20 20:14:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 37s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	1
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@10/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
14:14:55	API Interceptor	5x Sleep call for process: file.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.53.8	WinFIG.exe	Get hash	malicious	LummaC	Browse
	WinFIG-2024.exe	Get hash	malicious	LummaC	Browse
	Download.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	cH4EGgNUR7.exe	Get hash	malicious	LummaC	Browse
	6FecO9d3l9.exe	Get hash	malicious	LummaC	Browse
	S3AYU5t2JP.exe	Get hash	malicious	LummaC, Amadey, Stealc	Browse
	PTc16LnPI5.exe	Get hash	malicious	LummaC	Browse
	yRMHuXP8fH.exe	Get hash	malicious	LummaC	Browse
104.102.49.254	http://gtm-cn-j4g3qqvf603.steamproxy1.com/	Get hash	malicious	Unknown	Browse	www.valvesoftware.com/legal.htm

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
sergei-esenin.com	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	WinFIG.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	WinFIG-2024.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	SentinelOculus.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	Download.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.53.8
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
steamcommunity.com	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	Unlock_Tool_2.3.1.exe	Get hash	malicious	Vidar	Browse	104.102.49.254
	WinFIG.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	WinFIG-2024.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	SentinelOculus.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	Download.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.102.49.254

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	RFQ_PO-GGA7765JK09_MATERIALS_SPECIFICATIONS.scr.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	104.26.12.205
	9XHFe6y4Dj.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	188.114.96.3
	WinFIG.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	WinFIG-2024.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	SentinelOculus.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	Download.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	Aquantia.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.53.8
AKAMAI-ASUS	bin.i586.elf	Get hash	malicious	Gafgyt, Mirai	Browse	23.218.148.10
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	Unlock_Tool_2.3.1.exe	Get hash	malicious	Vidar	Browse	104.102.49.254
	WinFIG.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	WinFIG-2024.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	SentinelOculus.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	Download.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8 104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8 104.102.49.254
	WinFIG.exe	Get hash	malicious	LummaC	Browse	104.21.53.8 104.102.49.254
	WinFIG-2024.exe	Get hash	malicious	LummaC	Browse	104.21.53.8 104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8 104.102.49.254
	SentinelOculus.exe	Get hash	malicious	LummaC	Browse	104.21.53.8 104.102.49.254
	Download.exe	Get hash	malicious	LummaC	Browse	104.21.53.8 104.102.49.254
	Aquantia.exe	Get hash	malicious	LummaC	Browse	104.21.53.8 104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8 104.102.49.254
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.53.8 104.102.49.254

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.534484323708315
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'905'088 bytes
MD5:	7a359b81462a150726f40ae4d2ca23d5
SHA1:	07cc406c2b3ffdc91180d0b63b72326b6e14afd2
SHA256:	09c2ebee2e986aa2147ae54994262812f682a9534335b4843d486765e83f56ca
SHA512:	2f178a6b6b003d91f31cc0a7164914424ddb6b5896bdf1a121c0a44b7a44b9d7d83dc5233e2542c6777c454ae152842c74a2f35e596e755f8e7727e2707dcc32
SSDEEP:	49152:u2IdLLhRslkktZswUW8veMEhg8RUgK4tfA:u7ZLhRUk+ZstR4hg8Rw
TLSH:	E7D529D1B84475CBD4CE16F49527CE4A591E03B8CB2048D3EC6EE4BAAD73CC625B6D28
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...J..f............................../...........@...........................0......F-...@.................................W...k..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x6fd000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66FFF14A [Fri Oct 4 13:44:42 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FF7A0FA5DAAh
rdmsr
sub al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007FF7A0FA7DA5h
add byte ptr [ebx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
and al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
and al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
inc eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5f057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x5f1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x5d000	0x25e00	92ac4f98a4fec1103ed53d4eb0e826c4	False	0.9994520936468647	data	7.97591323533163	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x5e000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x5f000	0x1000	0x200	fe72def8b74193a84232a780098a7ce0	False	0.150390625	data	1.04205214219471	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
qvddldgl	0x60000	0x29c000	0x29be00	2d42316faf21afadc538681d4c919889	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
dpjuhttd	0x2fc000	0x1000	0x400	2b941091d5810f1896b75fc1c784ddaa	False	0.76171875	data	6.003436691910802	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x2fd000	0x3000	0x2200	99d030fa22de64e1130c0a4d9edf7af8	False	0.06364889705882353	DOS executable (COM)	0.8162823539358479	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-20T20:14:56.284591+0200	2056471	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)	1	192.168.2.4	64746	1.1.1.1	53	UDP
2024-10-20T20:14:56.296573+0200	2056485	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)	1	192.168.2.4	57392	1.1.1.1	53	UDP
2024-10-20T20:14:56.356741+0200	2056483	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)	1	192.168.2.4	53536	1.1.1.1	53	UDP
2024-10-20T20:14:56.379461+0200	2056481	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)	1	192.168.2.4	59934	1.1.1.1	53	UDP
2024-10-20T20:14:56.391847+0200	2056479	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)	1	192.168.2.4	63702	1.1.1.1	53	UDP
2024-10-20T20:14:56.403458+0200	2056477	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)	1	192.168.2.4	52800	1.1.1.1	53	UDP
2024-10-20T20:14:56.417088+0200	2056475	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)	1	192.168.2.4	49285	1.1.1.1	53	UDP
2024-10-20T20:14:56.431526+0200	2056473	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)	1	192.168.2.4	49808	1.1.1.1	53	UDP
2024-10-20T20:14:58.475439+0200	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.4	49730	104.102.49.254	443	TCP
2024-10-20T20:14:59.486612+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49731	104.21.53.8	443	TCP
2024-10-20T20:14:59.486612+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49731	104.21.53.8	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 20, 2024 20:14:56.458782911 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 20, 2024 20:14:56.458838940 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 20, 2024 20:14:56.458913088 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 20, 2024 20:14:56.462052107 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 20, 2024 20:14:56.462074041 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 20, 2024 20:14:57.537305117 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 20, 2024 20:14:57.537427902 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 20, 2024 20:14:57.563060999 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 20, 2024 20:14:57.563091040 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 20, 2024 20:14:57.564243078 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 20, 2024 20:14:57.613473892 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 20, 2024 20:14:57.782322884 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 20, 2024 20:14:57.827400923 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 20, 2024 20:14:58.475492954 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 20, 2024 20:14:58.475522041 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 20, 2024 20:14:58.475601912 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 20, 2024 20:14:58.475611925 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 20, 2024 20:14:58.475655079 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 20, 2024 20:14:58.475691080 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 20, 2024 20:14:58.475702047 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 20, 2024 20:14:58.475716114 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 20, 2024 20:14:58.475742102 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 20, 2024 20:14:58.492386103 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 20, 2024 20:14:58.492414951 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 20, 2024 20:14:58.492475986 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 20, 2024 20:14:58.492482901 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 20, 2024 20:14:58.492794037 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 20, 2024 20:14:58.511614084 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 20, 2024 20:14:58.511674881 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 20, 2024 20:14:58.511841059 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 20, 2024 20:14:58.512831926 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 20, 2024 20:14:58.512849092 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 20, 2024 20:14:58.532066107 CEST	49731	443	192.168.2.4	104.21.53.8
Oct 20, 2024 20:14:58.532110929 CEST	443	49731	104.21.53.8	192.168.2.4
Oct 20, 2024 20:14:58.532202005 CEST	49731	443	192.168.2.4	104.21.53.8
Oct 20, 2024 20:14:58.532547951 CEST	49731	443	192.168.2.4	104.21.53.8
Oct 20, 2024 20:14:58.532560110 CEST	443	49731	104.21.53.8	192.168.2.4
Oct 20, 2024 20:14:59.319286108 CEST	443	49731	104.21.53.8	192.168.2.4
Oct 20, 2024 20:14:59.319360971 CEST	49731	443	192.168.2.4	104.21.53.8
Oct 20, 2024 20:14:59.322788000 CEST	49731	443	192.168.2.4	104.21.53.8
Oct 20, 2024 20:14:59.322798967 CEST	443	49731	104.21.53.8	192.168.2.4
Oct 20, 2024 20:14:59.323232889 CEST	443	49731	104.21.53.8	192.168.2.4
Oct 20, 2024 20:14:59.324529886 CEST	49731	443	192.168.2.4	104.21.53.8
Oct 20, 2024 20:14:59.324554920 CEST	49731	443	192.168.2.4	104.21.53.8
Oct 20, 2024 20:14:59.324616909 CEST	443	49731	104.21.53.8	192.168.2.4
Oct 20, 2024 20:14:59.486650944 CEST	443	49731	104.21.53.8	192.168.2.4
Oct 20, 2024 20:14:59.486769915 CEST	443	49731	104.21.53.8	192.168.2.4
Oct 20, 2024 20:14:59.486871958 CEST	49731	443	192.168.2.4	104.21.53.8
Oct 20, 2024 20:14:59.486898899 CEST	443	49731	104.21.53.8	192.168.2.4
Oct 20, 2024 20:14:59.486963987 CEST	443	49731	104.21.53.8	192.168.2.4
Oct 20, 2024 20:14:59.487032890 CEST	49731	443	192.168.2.4	104.21.53.8
Oct 20, 2024 20:14:59.487039089 CEST	443	49731	104.21.53.8	192.168.2.4
Oct 20, 2024 20:14:59.488737106 CEST	443	49731	104.21.53.8	192.168.2.4
Oct 20, 2024 20:14:59.488800049 CEST	49731	443	192.168.2.4	104.21.53.8
Oct 20, 2024 20:14:59.488843918 CEST	49731	443	192.168.2.4	104.21.53.8
Oct 20, 2024 20:14:59.488857031 CEST	443	49731	104.21.53.8	192.168.2.4
Oct 20, 2024 20:14:59.545918941 CEST	49732	443	192.168.2.4	104.21.53.8
Oct 20, 2024 20:14:59.545948982 CEST	443	49732	104.21.53.8	192.168.2.4
Oct 20, 2024 20:14:59.546016932 CEST	49732	443	192.168.2.4	104.21.53.8
Oct 20, 2024 20:14:59.546286106 CEST	49732	443	192.168.2.4	104.21.53.8
Oct 20, 2024 20:14:59.546294928 CEST	443	49732	104.21.53.8	192.168.2.4
Oct 20, 2024 20:15:00.269828081 CEST	49732	443	192.168.2.4	104.21.53.8

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 20, 2024 20:14:56.284590960 CEST	64746	53	192.168.2.4	1.1.1.1
Oct 20, 2024 20:14:56.293905020 CEST	53	64746	1.1.1.1	192.168.2.4
Oct 20, 2024 20:14:56.296572924 CEST	57392	53	192.168.2.4	1.1.1.1
Oct 20, 2024 20:14:56.306140900 CEST	53	57392	1.1.1.1	192.168.2.4
Oct 20, 2024 20:14:56.356740952 CEST	53536	53	192.168.2.4	1.1.1.1
Oct 20, 2024 20:14:56.365976095 CEST	53	53536	1.1.1.1	192.168.2.4
Oct 20, 2024 20:14:56.379461050 CEST	59934	53	192.168.2.4	1.1.1.1
Oct 20, 2024 20:14:56.388943911 CEST	53	59934	1.1.1.1	192.168.2.4
Oct 20, 2024 20:14:56.391846895 CEST	63702	53	192.168.2.4	1.1.1.1
Oct 20, 2024 20:14:56.400749922 CEST	53	63702	1.1.1.1	192.168.2.4
Oct 20, 2024 20:14:56.403458118 CEST	52800	53	192.168.2.4	1.1.1.1
Oct 20, 2024 20:14:56.412220001 CEST	53	52800	1.1.1.1	192.168.2.4
Oct 20, 2024 20:14:56.417088032 CEST	49285	53	192.168.2.4	1.1.1.1
Oct 20, 2024 20:14:56.427577019 CEST	53	49285	1.1.1.1	192.168.2.4
Oct 20, 2024 20:14:56.431525946 CEST	49808	53	192.168.2.4	1.1.1.1
Oct 20, 2024 20:14:56.441675901 CEST	53	49808	1.1.1.1	192.168.2.4
Oct 20, 2024 20:14:56.445210934 CEST	57129	53	192.168.2.4	1.1.1.1
Oct 20, 2024 20:14:56.452394962 CEST	53	57129	1.1.1.1	192.168.2.4
Oct 20, 2024 20:14:58.517244101 CEST	56786	53	192.168.2.4	1.1.1.1
Oct 20, 2024 20:14:58.531141043 CEST	53	56786	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 20, 2024 20:14:56.284590960 CEST	192.168.2.4	1.1.1.1	0xe6fb	Standard query (0)	clearancek.site	A (IP address)	IN (0x0001)	false
Oct 20, 2024 20:14:56.296572924 CEST	192.168.2.4	1.1.1.1	0xa42a	Standard query (0)	mobbipenju.store	A (IP address)	IN (0x0001)	false
Oct 20, 2024 20:14:56.356740952 CEST	192.168.2.4	1.1.1.1	0xb006	Standard query (0)	eaglepawnoy.store	A (IP address)	IN (0x0001)	false
Oct 20, 2024 20:14:56.379461050 CEST	192.168.2.4	1.1.1.1	0xdaef	Standard query (0)	dissapoiznw.store	A (IP address)	IN (0x0001)	false
Oct 20, 2024 20:14:56.391846895 CEST	192.168.2.4	1.1.1.1	0x9b1	Standard query (0)	studennotediw.store	A (IP address)	IN (0x0001)	false
Oct 20, 2024 20:14:56.403458118 CEST	192.168.2.4	1.1.1.1	0x8928	Standard query (0)	bathdoomgaz.store	A (IP address)	IN (0x0001)	false
Oct 20, 2024 20:14:56.417088032 CEST	192.168.2.4	1.1.1.1	0x8c89	Standard query (0)	spirittunek.store	A (IP address)	IN (0x0001)	false
Oct 20, 2024 20:14:56.431525946 CEST	192.168.2.4	1.1.1.1	0xd69e	Standard query (0)	licendfilteo.site	A (IP address)	IN (0x0001)	false
Oct 20, 2024 20:14:56.445210934 CEST	192.168.2.4	1.1.1.1	0x4086	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Oct 20, 2024 20:14:58.517244101 CEST	192.168.2.4	1.1.1.1	0x27a2	Standard query (0)	sergei-esenin.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 20, 2024 20:14:56.293905020 CEST	1.1.1.1	192.168.2.4	0xe6fb	Name error (3)	clearancek.site	none	none	A (IP address)	IN (0x0001)	false
Oct 20, 2024 20:14:56.306140900 CEST	1.1.1.1	192.168.2.4	0xa42a	Name error (3)	mobbipenju.store	none	none	A (IP address)	IN (0x0001)	false
Oct 20, 2024 20:14:56.365976095 CEST	1.1.1.1	192.168.2.4	0xb006	Name error (3)	eaglepawnoy.store	none	none	A (IP address)	IN (0x0001)	false
Oct 20, 2024 20:14:56.388943911 CEST	1.1.1.1	192.168.2.4	0xdaef	Name error (3)	dissapoiznw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 20, 2024 20:14:56.400749922 CEST	1.1.1.1	192.168.2.4	0x9b1	Name error (3)	studennotediw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 20, 2024 20:14:56.412220001 CEST	1.1.1.1	192.168.2.4	0x8928	Name error (3)	bathdoomgaz.store	none	none	A (IP address)	IN (0x0001)	false
Oct 20, 2024 20:14:56.427577019 CEST	1.1.1.1	192.168.2.4	0x8c89	Name error (3)	spirittunek.store	none	none	A (IP address)	IN (0x0001)	false
Oct 20, 2024 20:14:56.441675901 CEST	1.1.1.1	192.168.2.4	0xd69e	Name error (3)	licendfilteo.site	none	none	A (IP address)	IN (0x0001)	false
Oct 20, 2024 20:14:56.452394962 CEST	1.1.1.1	192.168.2.4	0x4086	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false
Oct 20, 2024 20:14:58.531141043 CEST	1.1.1.1	192.168.2.4	0x27a2	No error (0)	sergei-esenin.com		104.21.53.8	A (IP address)	IN (0x0001)	false
Oct 20, 2024 20:14:58.531141043 CEST	1.1.1.1	192.168.2.4	0x27a2	No error (0)	sergei-esenin.com		172.67.206.204	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

sergei-esenin.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	104.102.49.254	443	6372	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-20 18:14:57 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-10-20 18:14:58 UTC	1891	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://ste [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Sun, 20 Oct 2024 18:14:58 GMT Content-Length: 34508 Connection: close Set-Cookie: sessionid=e6a0f35c3786079464e2950d; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C0e3d185a3e106e73b244decdec33a0ea; Path=/; Secure; HttpOnly; SameSite=None
2024-10-20 18:14:58 UTC	14493	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-10-20 18:14:58 UTC	16384	IN	Data Raw: 65 74 59 27 3a 2d 36 2c 20 27 6f 66 66 73 65 74 58 27 3a 20 31 2c 20 27 68 6f 72 69 7a 6f 6e 74 61 6c 53 6e 61 70 27 3a 20 34 2c 20 27 74 6f 6f 6c 74 69 70 50 61 72 65 6e 74 27 3a 20 27 23 67 6c 6f 62 61 6c 5f 68 65 61 64 65 72 20 2e 73 75 70 65 72 6e 61 76 5f 63 6f 6e 74 61 69 6e 65 72 27 2c 20 27 63 6f 72 72 65 63 74 46 6f 72 53 63 72 65 65 6e 53 69 7a 65 27 3a 20 66 61 6c 73 65 7d 29 3b 0d 0a 09 09 7d 29 3b 0d 0a 09 3c 2f 73 63 72 69 70 74 3e 0d 0a 0d 0a 09 09 3c 64 69 76 20 69 64 3d 22 67 6c 6f 62 61 6c 5f 61 63 74 69 6f 6e 73 22 3e 0d 0a 09 09 09 3c 64 69 76 20 72 6f 6c 65 3d 22 6e 61 76 69 67 61 74 69 6f 6e 22 20 69 64 3d 22 67 6c 6f 62 61 6c 5f 61 63 74 69 6f 6e 5f 6d 65 6e 75 22 20 61 72 69 61 2d 6c 61 62 65 6c 3d 22 41 63 63 6f 75 6e 74 20 4d 65 Data Ascii: etY':-6, 'offsetX': 1, 'horizontalSnap': 4, 'tooltipParent': '#global_header .supernav_container', 'correctForScreenSize': false});});</script><div id="global_actions"><div role="navigation" id="global_action_menu" aria-label="Account Me

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	104.21.53.8	443	6372	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-20 18:14:59 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: sergei-esenin.com
2024-10-20 18:14:59 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-20 18:14:59 UTC	560	IN	HTTP/1.1 403 Forbidden Date: Sun, 20 Oct 2024 18:14:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Frame-Options: SAMEORIGIN Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7NBve1yZenzcS24YSNAg1NZSkRWPUyTYji1ee7z3FEEY4zhZTRD5CWlyA%2F9LQVKB6eW9LFhx37SWaOAm6iIHFnMEudmJiVr%2BAMtOpWlEFn4w0xzV4C5kbz8zIc%2FyGvMplhRwTg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d5afd9d4b962ac0-LAX
2024-10-20 18:14:59 UTC	809	IN	Data Raw: 31 31 35 33 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 Data Ascii: 1153<!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if
2024-10-20 18:14:59 UTC	1369	IN	Data Raw: 69 2f 73 74 79 6c 65 73 2f 63 66 2e 65 72 72 6f 72 73 2e 69 65 2e 63 73 73 22 20 2f 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 3c 2f 73 74 79 6c 65 3e 0a 0a 0a 3c 21 2d 2d 5b 69 66 20 67 74 65 20 49 45 20 31 30 5d 3e 3c 21 2d 2d 3e 0a 3c 73 63 72 69 70 74 3e 0a 20 20 69 66 20 28 21 6e 61 76 69 67 61 74 6f 72 2e 63 6f 6f 6b 69 65 45 6e 61 62 6c 65 64 29 20 7b 0a 20 20 20 20 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 27 2c 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0a 20 20 20 20 20 20 76 61 72 20 63 6f 6f 6b 69 65 45 6c 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 Data Ascii: i/styles/cf.errors.ie.css" /><![endif]--><style>body{margin:0;padding:0}</style>...[if gte IE 10]>...><script> if (!navigator.cookieEnabled) { window.addEventListener('DOMContentLoaded', function () { var cookieEl = document.getElementB
2024-10-20 18:14:59 UTC	1369	IN	Data Raw: 73 2d 6d 61 6e 61 67 65 6d 65 6e 74 2f 70 68 69 73 68 69 6e 67 2d 61 74 74 61 63 6b 2f 22 20 63 6c 61 73 73 3d 22 63 66 2d 62 74 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 34 30 34 30 34 30 3b 20 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 20 62 6f 72 64 65 72 3a 20 30 3b 22 3e 4c 65 61 72 6e 20 4d 6f 72 65 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 66 6f 72 6d 20 61 63 74 69 6f 6e 3d 22 2f 63 64 6e 2d 63 67 69 2f 70 68 69 73 68 2d 62 79 70 61 73 73 22 20 6d 65 74 68 6f 64 3d 22 47 45 54 22 20 65 6e 63 74 79 70 65 3d 22 74 65 78 74 2f 70 6c 61 69 6e 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: s-management/phishing-attack/" class="cf-btn" style="background-color: #404040; color: #fff; border: 0;">Learn More</a> <form action="/cdn-cgi/phish-bypass" method="GET" enctype="text/plain">
2024-10-20 18:14:59 UTC	896	IN	Data Raw: 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 73 65 70 61 72 61 74 6f 72 20 73 6d 3a 68 69 64 64 65 6e 22 3e 26 62 75 6c 6c 3b 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 20 73 6d 3a 62 6c 6f 63 6b 20 73 6d 3a 6d 62 2d 31 22 3e 3c 73 70 61 6e 3e 50 65 72 66 6f 72 6d 61 6e 63 65 20 26 61 6d 70 3b 20 73 65 63 75 72 69 74 79 20 62 79 3c 2f 73 70 61 6e 3e 20 3c 61 20 72 65 6c 3d 22 6e 6f 6f 70 65 6e 65 72 20 6e 6f 72 65 66 65 72 72 65 72 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 35 78 78 2d 65 72 72 6f 72 2d 6c 61 6e 64 69 6e 67 Data Ascii: /span> <span class="cf-footer-separator sm:hidden">•</span> </span> <span class="cf-footer-item sm:block sm:mb-1"><span>Performance & security by</span> <a rel="noopener noreferrer" href="https://www.cloudflare.com/5xx-error-landing

Target ID:	0
Start time:	14:14:53
Start date:	20/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x550000
File size:	2'905'088 bytes
MD5 hash:	7A359B81462A150726F40AE4D2CA23D5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	57.4%
Total number of Nodes:	61
Total number of Limit Nodes:	6

Executed Functions

Function 0055FCA0 Relevance: 6.6, Strings: 5, Instructions: 373
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ek29QrYh_BrBdY6dMY92u8XuaeDJV.hg2ExBLaaPlIA-1729448099-0.0.1.1-/api, xrefs: 00560137, 00560154
J|BJ, xrefs: 0056000D
t, xrefs: 0055FCBE
V, xrefs: 0055FEDC
VY^_, xrefs: 0055FDFF

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID: J|BJ$V$VY^_$ek29QrYh_BrBdY6dMY92u8XuaeDJV.hg2ExBLaaPlIA-1729448099-0.0.1.1-/api$t
API String ID: 0-3236621253
Opcode ID: 94e99bb879a99953c4626b04c74b84ddea546b4fe90764c9e2e863e955119bfd
Instruction ID: 49031d9f418afbc9ab14564198c81c9632c3c32d88c611b57d328dd293dac75d
Opcode Fuzzy Hash: 94e99bb879a99953c4626b04c74b84ddea546b4fe90764c9e2e863e955119bfd
Instruction Fuzzy Hash: 32D1657450C3809BD711DF14989462FBFE1BB96B45F58882DF8C98B292C336CD49DB92

Function 0058F620 Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 461
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

hi, xrefs: 0058F6E6
dg, xrefs: 0058F7F5

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID: dg$hi
API String ID: 0-2859417413
Opcode ID: dab238be4ac1e733ee5fa6abda45cfa4476f70120622ec2e01413f482a26810a
Instruction ID: 19e6bb5c7048884144116ab898b250add8874a3883647d038a697ef71514d765
Opcode Fuzzy Hash: dab238be4ac1e733ee5fa6abda45cfa4476f70120622ec2e01413f482a26810a
Instruction Fuzzy Hash: 62F19571618301EFE704DF28D892B2ABBF6FB9A344F14892CF5959B2A1C734D845CB12

Function 0055D110 Relevance: 1.7, APIs: 1, Instructions: 168
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(00000000), ref: 0055D2F1

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 01c3ae2bec3eaecfd3b13d745d97520d0c95ca4649ab42a8742ca70ddaaffefb
Instruction ID: c6bef12489cb9b3ec1125007d40725248c1969bfd61ffb6060ca1df58c811bea
Opcode Fuzzy Hash: 01c3ae2bec3eaecfd3b13d745d97520d0c95ca4649ab42a8742ca70ddaaffefb
Instruction Fuzzy Hash: 6F41347540D340ABD721BB68D5A8A2EFFF5AF92706F048C0DE9C497212C236D8588B67

Function 00595700 Relevance: 1.6, APIs: 1, Instructions: 69
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlReAllocateHeap.NTDLL(?,00000000,?,?), ref: 00595784

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: c1f8d88e7074127caff3dd93dfb0c30b473aad852589662f2a0395268541f46e
Instruction ID: c365c13b28050915c3b17d26ada0b11eab7f020f3da4c5f7c080bab1acd30a1f
Opcode Fuzzy Hash: c1f8d88e7074127caff3dd93dfb0c30b473aad852589662f2a0395268541f46e
Instruction Fuzzy Hash: 1B119E7591C240EBC702AF68E845A1BBFF5EF96710F058828F4C59B222D335D925DBA2

Function 00595BB0 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(0059973D,005C003F,00000006,?,?,00000018,8C8D8A8B,?,?), ref: 00595BDE

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction ID: fb6f357373f259be8b0e83fffc5d2a3912a28e0da7d2036ce94b71e982b3a7e9
Opcode Fuzzy Hash: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction Fuzzy Hash: 76E0FE75908316AB9A09CF45C14444EFBE5BFC4714F11CC8DA4D867210D3B0AD46DF82

Function 0059695B Relevance: 1.4, Strings: 1, Instructions: 100COMMON

Download Yara Rule

Strings

@, xrefs: 005969C5

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 22d1cb5070e09c5afc7609ab50bf0790869b954c26962aecac387fac0673030a
Instruction ID: d1c5f646c0cadc286adbb2bbb6c79e41c1c83df3402f836222f9b500f1055112
Opcode Fuzzy Hash: 22d1cb5070e09c5afc7609ab50bf0790869b954c26962aecac387fac0673030a
Instruction Fuzzy Hash: 133178B15183019FDB18DF14D890B2BBBF2FF95384F48981CE5C6A7261E3389948CB56

Function 0056049B Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e963cd6efa0cdde9aaacafb67ca851498fe6359612585eee4cecb7e99873a245
Instruction ID: a6425ac7c4f09b5bfa69194e4dc084550e8ae37a2189bc4012fea70dec40496c
Opcode Fuzzy Hash: e963cd6efa0cdde9aaacafb67ca851498fe6359612585eee4cecb7e99873a245
Instruction Fuzzy Hash: B8918D75200B01CFD724CF25D894A27B7FAFF89310B118A6DE856CB6A1D771E819DB50

Function 00560228 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69ebdf17bad1bf3fdee3ab9bc08d64d287639daace791e2958b4e08ce859d941
Instruction ID: 95aea7a5c3ab27e7b5ec5cbb06d16198b717c29e18bdb7d1581707732288ccc0
Opcode Fuzzy Hash: 69ebdf17bad1bf3fdee3ab9bc08d64d287639daace791e2958b4e08ce859d941
Instruction Fuzzy Hash: 30718C74200701DFD7248F60E898A27BBFAFF89311F118969E846CB6A2C771E819DF50

Function 005999D0 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47bbce55a67b6266560dcbf8a470e247f4f80fc443b3e01cde37764e09d81f1d
Instruction ID: f32d3a5832b1bdb7b24259681dca4b8fb9b0cbd6287840b96843a17f1cf169dc
Opcode Fuzzy Hash: 47bbce55a67b6266560dcbf8a470e247f4f80fc443b3e01cde37764e09d81f1d
Instruction Fuzzy Hash: 78417F34208300ABDB149A19D891B2FFBEAFB96754F54882CE58A97251D335E811DB62

Function 005963B8 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e5d8574b8641c5fb0b5aff29f3ec52eedfcfd38132226c84106425a4f219ea53
Instruction ID: cc37e579b9c3489af1efa3d473485bd0614c2be66af0dcccbbafd2c865cf43fb
Opcode Fuzzy Hash: e5d8574b8641c5fb0b5aff29f3ec52eedfcfd38132226c84106425a4f219ea53
Instruction Fuzzy Hash: CA310970209301BFDE14DB04CD81F3ABBA5FB91750FA4890CF185571E1D370A8189B52

Function 00560EEC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb9549149c697a4cb8821e87df181ab6c26a68d4d03fb22c9acd0ad72a33b00e
Instruction ID: 9c604601a661a07936639335936648bee97af758df37e97d34bbe0ef8f9f94dd
Opcode Fuzzy Hash: cb9549149c697a4cb8821e87df181ab6c26a68d4d03fb22c9acd0ad72a33b00e
Instruction Fuzzy Hash: 922139B490021A9FDB15CF94CC90BBFBBB1FB4A304F144849E411BB292C775A951CFA4

Function 00562F94 Relevance: 15.9, APIs: 1, Strings: 9, Instructions: 862
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoUninitialize.COMBASE ref: 00563378

Strings

AR]J, xrefs: 0056303F
jxEJ, xrefs: 0056302B
YTfT, xrefs: 00563832
E9F71194B083C636ED0186A1FFE92B78, xrefs: 00562F94
IK, xrefs: 00563178
sergei-esenin.com, xrefs: 0056334C, 00563B12
[Pcl, xrefs: 00563839
HLB6, xrefs: 00563855
jXl>, xrefs: 00563847

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID: Uninitialize
String ID: AR]J$E9F71194B083C636ED0186A1FFE92B78$HLB6$YTfT$[Pcl$jXl>$jxEJ$sergei-esenin.com$IK
API String ID: 3861434553-506854138
Opcode ID: 242c511aba1f23303b32cedf0c00249739e303859cfd1a218963131675af3aa1
Instruction ID: 144ab36c3b128f02fbbdc1e7ba3a532195139ff2e48e20abd56e0371377d3210
Opcode Fuzzy Hash: 242c511aba1f23303b32cedf0c00249739e303859cfd1a218963131675af3aa1
Instruction Fuzzy Hash: 586296B0100B808BD7229F34D895BA7BBF5FF1A304F44496DE4EB8B252D735A658CB21

Function 00593220 Relevance: 1.6, APIs: 1, Instructions: 59
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(?,00000000), ref: 005932A6

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: e95abcf179093efd85a3eb993375951bc5a0be2f2be6d7e83e65e4f7be5501ff
Instruction ID: 58f653a7f2cb3b4cd2908344f79379dd0d18fa4ac8e67aec633b62ff4cf226a8
Opcode Fuzzy Hash: e95abcf179093efd85a3eb993375951bc5a0be2f2be6d7e83e65e4f7be5501ff
Instruction Fuzzy Hash: 4C014B3450D240DBCB01AB18E845A1ABBE8EF5A705F054C1CE5C58B361D235DD64DBA6

Function 0058F54B Relevance: 1.6, APIs: 1, Instructions: 52
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32 ref: 0058F5CD

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID: AllocString
String ID:
API String ID: 2525500382-0
Opcode ID: 35a421aa349f70917ff631594ce25084dfacabada86ebac9ce7e5b1e775569f4
Instruction ID: 91a1257ad27e79c2cf6c4b2b66a5d89e3402d6c5192aebc0791584cb0ac17747
Opcode Fuzzy Hash: 35a421aa349f70917ff631594ce25084dfacabada86ebac9ce7e5b1e775569f4
Instruction Fuzzy Hash: 3A012CB0108341ABE340DF14C484A1FBFF5AB86398F84994CF5C89B2A2D735D844CBA2

Function 0058F5FC Relevance: 1.5, APIs: 1, Instructions: 13
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 0058F60F

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 18b8ffd1f01941b36bb0b4ea94c53f12a24029a15b2e101550930d03250da172
Instruction ID: 749f9fa0d3d7506fe952b02537f674ef48fd198769bfe04f112f119952d4e3a8
Opcode Fuzzy Hash: 18b8ffd1f01941b36bb0b4ea94c53f12a24029a15b2e101550930d03250da172
Instruction Fuzzy Hash: 75C092303E4302BAF6320A19ACA7F1A7175B793F02F701804B7407C0D08EF66224AA9E

Function 00562F6F Relevance: 1.5, APIs: 1, Instructions: 13
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 00562F82

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: dd0263774c638d4df2670c3cf456897b247b0b5772315c8991bd84aa93f37b0a
Instruction ID: 7b58b714c4cafcf4431613d0c51ee0ac59274b93af1fb37adb7ecb0e3de5b920
Opcode Fuzzy Hash: dd0263774c638d4df2670c3cf456897b247b0b5772315c8991bd84aa93f37b0a
Instruction Fuzzy Hash: 55C092313D8305B0F03006086C63F0520045302F20F700B11B330BC1D089D53104921C

Function 00593202 Relevance: 1.5, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000), ref: 00593208

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: cebc1b507502f12eeadccc6945fcc879ad4b214525f708c9ec9e497580c10183
Instruction ID: f3f3affba7d33e358244665b3235d1ae74aeaa5cd08133ce82cb834a9c7e2afe
Opcode Fuzzy Hash: cebc1b507502f12eeadccc6945fcc879ad4b214525f708c9ec9e497580c10183
Instruction Fuzzy Hash: 56B012340400005FDA082B00EC0AF003520EB10605F800050E501040B1D1715868D564

Function 00562F10 Relevance: 1.3, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00562F5F

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 458690e42c98b4ecc1730d9a881c66995c8a7c5b6ed3e6e4c191ede83ae5607b
Instruction ID: 8172bd64850df4f250cbf4b2bbbb3746a4aacbb80c8fb18d19068cd4005f8c72
Opcode Fuzzy Hash: 458690e42c98b4ecc1730d9a881c66995c8a7c5b6ed3e6e4c191ede83ae5607b
Instruction Fuzzy Hash: F0F019A5D117006BD7707A3D9E0B7177D78A706660F400729ECE5567C4F620A41DCBD7

Non-executed Functions

Function 0056DB6F Relevance: 32.0, Strings: 24, Instructions: 2006COMMON

Download Yara Rule

Strings

lkji, xrefs: 0056E73E
`onm, xrefs: 0056E733
WP, xrefs: 0056DCEF
D, xrefs: 0056E846
89>?, xrefs: 0056E9F6
QNOL, xrefs: 0056E775
dcba, xrefs: 0056E728
%*+(, xrefs: 0056DE37, 0056DE46
tsrq, xrefs: 0056E6FC
DCBA, xrefs: 0056E887, 0056E896
:WUE, xrefs: 0056F6B7, 0056F6C6
xgfe, xrefs: 0056E71D
<=2, xrefs: 0056EA01
|, xrefs: 0056ECB1
LKJI, xrefs: 0056E6E6
@ONM, xrefs: 0056E6DB
tuJK, xrefs: 0056E967
()./, xrefs: 0056E9CA
AR, xrefs: 0056DD10
mjkh, xrefs: 0056E7D8
89&', xrefs: 0056E93B
T, xrefs: 0056F157
<=:;, xrefs: 0056E930
`Y^_, xrefs: 0056E99E

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID: InitializeThunk
String ID: %*+($()./$89&'$89>?$:WUE$<=2$<=:;$@ONM$AR$D$DCBA$LKJI$QNOL$T$WP$`Y^_$`onm$dcba$lkji$mjkh$tsrq$tuJK$xgfe$|
API String ID: 2994545307-1418943773
Opcode ID: ac0f382cdd2e7b4e5e20e6145953f0b202b82f2002050b97901757bf9c143d4c
Instruction ID: 620215beb89509270491d25f10cd742cf9258103a224c3e55114386bce1c0469
Opcode Fuzzy Hash: ac0f382cdd2e7b4e5e20e6145953f0b202b82f2002050b97901757bf9c143d4c
Instruction Fuzzy Hash: 49F276B45093829BD770CF14D885BABBBE6BFD5344F144C2CE4C98B252EB319984DB92

Function 005823E0 Relevance: 31.3, APIs: 4, Strings: 12, Instructions: 3298COMMON

Download Yara Rule

Strings

{l`~, xrefs: 0058268C
|}&C, xrefs: 00582F21
fedc, xrefs: 00582782
Cx, xrefs: 0058453D
mlc@, xrefs: 0058275C
%*+(, xrefs: 005840EF
`tii, xrefs: 00582693
aenQ, xrefs: 0058276A
f@~!, xrefs: 005825FF
3<, xrefs: 005832D6
ggxz, xrefs: 00582685
:, xrefs: 005832DD

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID: %*+($3<$:$Cx$`tii$aenQ$f@~!$fedc$ggxz$mlc@${l`~$|}&C
API String ID: 0-786070067
Opcode ID: 482476d6196c82de3c9c8c4ec6026e2b81ee76dccb9549ea0e518fa2b6029fb7
Instruction ID: 977d98ec5914947b7b8d8b14329f9e93f445316e1a95c3082a5cdd95d676d332
Opcode Fuzzy Hash: 482476d6196c82de3c9c8c4ec6026e2b81ee76dccb9549ea0e518fa2b6029fb7
Instruction Fuzzy Hash: 4133DD70104B818FD7259F38C590B62BFE1BF56304F58899DD8DAABB92C735E806CB61

Function 00579F62 Relevance: 21.7, Strings: 17, Instructions: 473COMMON

Download Yara Rule

Strings

WQ, xrefs: 0057A62B
(a*c, xrefs: 0057A147
WH, xrefs: 0057AA1C
CG, xrefs: 0057AA32
_Y, xrefs: 0057A641
=], xrefs: 0057A36A
kW, xrefs: 0057A380
Gt, xrefs: 00579FF8
N[, xrefs: 0057A375
sm, xrefs: 0057A830
]{, xrefs: 0057A1E7, 0057A1F3
?m,o, xrefs: 0057A13C
S], xrefs: 0057A636
%e6g, xrefs: 0057A152
/), xrefs: 0057A66D
hi, xrefs: 0057AB9D
JG, xrefs: 0057AA27

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID: %e6g$(a*c$=]$?m,o$CG$Gt$JG$N[$WH$]{$hi$kW$/)$S]$WQ$_Y$sm
API String ID: 0-1131134755
Opcode ID: 16676eeaad759d038072df077affdcbec80adb571e696f5d2ffb5beac892363d
Instruction ID: f15b64cb52bba6390bdc94c6cb035f1e0ea8e4940c938c1cb28e597a9d8ef22a
Opcode Fuzzy Hash: 16676eeaad759d038072df077affdcbec80adb571e696f5d2ffb5beac892363d
Instruction Fuzzy Hash: 1452B6B844D385CAE270CF25D585B8EBAF1BB92740F608A1DE1ED9B255DB708049CF93

Function 00579510 Relevance: 20.4, Strings: 16, Instructions: 427COMMON

Download Yara Rule

Strings

O+f), xrefs: 00579634, 0057963D
G+X5, xrefs: 00579AF3
pq, xrefs: 005799E0
B7U1, xrefs: 00579AFB
8;, xrefs: 00579B13
T#a-, xrefs: 00579AE3
L3Y=, xrefs: 00579B03
2A"_, xrefs: 00579980
X/R), xrefs: 00579AEB
,A&C, xrefs: 0057982E
G'M!, xrefs: 00579ADB
z=Q?, xrefs: 00579826
B?Q9, xrefs: 00579B0B
;IJK, xrefs: 0057983E
!E4G, xrefs: 00579836
?M0K, xrefs: 00579968

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID: !E4G$,A&C$2A"_$8;$;IJK$?M0K$B7U1$B?Q9$G'M!$G+X5$L3Y=$O+f)$T#a-$X/R)$pq$z=Q?
API String ID: 0-655414846
Opcode ID: 0813b743d90f4b34127462dcc5ff83c71d3fb966d1c2e6861fab29fd1dc8ca07
Instruction ID: 13fa2383f3d91e5eb4b15854b7291e15e4b6de796c581f10717f717e96701fca
Opcode Fuzzy Hash: 0813b743d90f4b34127462dcc5ff83c71d3fb966d1c2e6861fab29fd1dc8ca07
Instruction Fuzzy Hash: 4CF130B4518381ABD310DF15E881A2BBBF4FB96744F148D1CF4D99B252D334D908EBA6

Function 0057DD29 Relevance: 18.6, Strings: 14, Instructions: 1142COMMON

Download Yara Rule

Strings

=]+_, xrefs: 0057E276
upH}, xrefs: 0057DE8A, 0057E798, 0057DF4A
)IgK, xrefs: 0057E261
Y9N;, xrefs: 0057E245
n\+H, xrefs: 0057DDC0
rW, xrefs: 0057E92E
W, xrefs: 0057E9C5
%*+(, xrefs: 0057E143
<Y.[, xrefs: 0057E27D
{E, xrefs: 0057E323
-M2O, xrefs: 0057E25A
,Q?S, xrefs: 0057E26F
hX]N, xrefs: 0057DDC7
W, xrefs: 0057E403, 0057E664, 0057E7BD

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID: W$%*+($)IgK$,Q?S$-M2O$<Y.[$=]+_$Y9N;$hX]N$n\+H$rW$upH}${E$W
API String ID: 0-3103588018
Opcode ID: 74bb48acd75aefcf24f185a38ce7c782522f6619aeab357fe24cc57f3fc1bf6f
Instruction ID: 41b2b45078b98ca05d12d1799977c83207614adb6ae16ece121c9e712e88872f
Opcode Fuzzy Hash: 74bb48acd75aefcf24f185a38ce7c782522f6619aeab357fe24cc57f3fc1bf6f
Instruction Fuzzy Hash: A2922675E00616CFDB04CF68D8516AEBFB2FF9A310F298168E416AB391D735AD05CB90

Function 007251C4 Relevance: 15.3, Strings: 11, Instructions: 1588COMMON

Download Yara Rule

Strings

SOm, xrefs: 007253A3
&u=, xrefs: 00725778
eD0, xrefs: 007258FE
Rnw, xrefs: 00725391
S#^, xrefs: 00725518
P}>, xrefs: 00725E2E
V}, xrefs: 00725C14
W_kE, xrefs: 0072598A
|u?, xrefs: 007254FE
vREx, xrefs: 00726352
Pp{, xrefs: 0072603E

Memory Dump Source

Source File: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID: V}$&u=$P}>$Rnw$S#^$SOm$W_kE$eD0$vREx$|u?$Pp{
API String ID: 0-2499182234
Opcode ID: ca4a9d799f1eac422fab1ecea5575551db963a156dcfd69ab9bebe5b5273b09b
Instruction ID: 23d770f71382eb9c2c762c6328e7f08d34e394ef16aca7e5c9eece86f6346044
Opcode Fuzzy Hash: ca4a9d799f1eac422fab1ecea5575551db963a156dcfd69ab9bebe5b5273b09b
Instruction Fuzzy Hash: 1CB2E5F360C200AFE704AE29EC8567AFBE5EF94720F1A893DE6C4C7744E63558418697

Function 0057098B Relevance: 10.8, Strings: 8, Instructions: 836COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00570A77, 00570A86
9.5^, xrefs: 00570F9F
,#15, xrefs: 00570F94
{, xrefs: 00571502
qrqp, xrefs: 00571089
&> &, xrefs: 00570F89
gce/, xrefs: 00571073
cah`, xrefs: 0057107E

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID: %*+($&> &$,#15$9.5^$cah`$gce/$qrqp${
API String ID: 0-4102007303
Opcode ID: 940e7e2b6892a76fac79e02202825a2d20372bd8e7d729556e1d3e5d814d09b4
Instruction ID: 9604ee10536c71583399cde3758cbc8f239234530ab5023570dc2ccf554c28a6
Opcode Fuzzy Hash: 940e7e2b6892a76fac79e02202825a2d20372bd8e7d729556e1d3e5d814d09b4
Instruction Fuzzy Hash: 636289B15083818FD730CF14E895BABBBE1FF96314F08892DE49A8B681E3759944DB53

Function 00551000 Relevance: 10.5, Strings: 7, Instructions: 1785COMMON

Download Yara Rule

Strings

-, xrefs: 005521ED
0123456789abcdefxp, xrefs: 00551587, 005515F8
gfff, xrefs: 00552226
gfff, xrefs: 00552297
0123456789ABCDEFXP, xrefs: 0055157D, 005515EB
@, xrefs: 00552C40
gfff, xrefs: 005522E1

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID: -$0123456789ABCDEFXP$0123456789abcdefxp$@$gfff$gfff$gfff
API String ID: 0-2517803157
Opcode ID: 05425245a920c6ee2a3722610d0129f35747f6249f0c37d04abfc9aa280abac2
Instruction ID: f2fa12586aa4d3789d6014944b7cac64b2cb9d97a99d21b453ebc949e9100f0d
Opcode Fuzzy Hash: 05425245a920c6ee2a3722610d0129f35747f6249f0c37d04abfc9aa280abac2
Instruction Fuzzy Hash: 12D2F3316087418FD718CE28C4A436ABFE2BFD5355F188A2EE899C7391D774D949CB82

Function 0071B213 Relevance: 9.1, Strings: 6, Instructions: 1567COMMON

Download Yara Rule

Strings

Nr, xrefs: 0071B90C
Ms/, xrefs: 0071C0A2
5?m, xrefs: 0071C369
OE_, xrefs: 0071B8CE
6mf|, xrefs: 0071BDD2
(~c}, xrefs: 0071B384

Memory Dump Source

Source File: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID: Nr$(~c}$5?m$6mf|$Ms/$OE_
API String ID: 0-4132050663
Opcode ID: 13ae14ab9d9fc35ea4f398bfc1563146e8e1a71f2e06dca8061dd62224f0fcb4
Instruction ID: 759ab0f28f01c8afa61e91259507e5669b9ec3d65815a518914a1a53be244dd0
Opcode Fuzzy Hash: 13ae14ab9d9fc35ea4f398bfc1563146e8e1a71f2e06dca8061dd62224f0fcb4
Instruction Fuzzy Hash: D8B217F360C6009FE3046E29EC8567AFBE5EF94720F1A893DEAC4C7744E63598458687

Function 0071820E Relevance: 7.3, Strings: 5, Instructions: 1096COMMON

Download Yara Rule

Strings

t77{, xrefs: 007187FE
%_/, xrefs: 0071868F
%_/, xrefs: 007186C3
d#3, xrefs: 0071834D
;}U^, xrefs: 00718CD8

Memory Dump Source

Source File: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID: %_/$%_/$;}U^$d#3$t77{
API String ID: 0-662413217
Opcode ID: 1ba517ff8b2789388d8519964d3306830ffd754e92eec4c37a59771ab54840e8
Instruction ID: 36aa7b519b4ca4ac5e49ce73e82abb43fb135c8f2d863705201a8de767d3d01d
Opcode Fuzzy Hash: 1ba517ff8b2789388d8519964d3306830ffd754e92eec4c37a59771ab54840e8
Instruction Fuzzy Hash: F5725AF36082049FE3046E2DEC8567ABBE9EFD4720F1A493DE6C5C7344EA3598458693

Function 005512F7 Relevance: 7.2, Strings: 5, Instructions: 922COMMON

Download Yara Rule

Strings

0, xrefs: 0055243E
0, xrefs: 00551DC1
@, xrefs: 00553531
i, xrefs: 005528EA
0, xrefs: 00551E88

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID: 0$0$0$@$i
API String ID: 0-3124195287
Opcode ID: f8f80fee96b0f05dfe49dcc7b6c47da2ab49992f3f81afe67fa9900cfce1dffb
Instruction ID: 6fb5f2cedce675ed0d54006132a780452e8a07cf0ab427c3d6e806d05580dff4
Opcode Fuzzy Hash: f8f80fee96b0f05dfe49dcc7b6c47da2ab49992f3f81afe67fa9900cfce1dffb
Instruction Fuzzy Hash: 1662C27160C3818BD319CE28C4A476ABFE1BFD6345F188D1EE8D987291E774D949CB82

Function 0055164F Relevance: 6.7, Strings: 5, Instructions: 472COMMON

Download Yara Rule

Strings

gfff, xrefs: 00551F57
0123456789abcdefxp, xrefs: 00551659
0123456789ABCDEFXP, xrefs: 0055164F
gfff, xrefs: 00551F3C
+, xrefs: 00551573

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID: +$0123456789ABCDEFXP$0123456789abcdefxp$gfff$gfff
API String ID: 0-1123320326
Opcode ID: 1ef8c7870e84a240535d71bb138f60a58f479ca8df2d3cd8415f535e9707aa8e
Instruction ID: 9e847e7915bf501b4f7a153b6cd1f44f6c7f5354f701b0e4cc3cfdc8a54d834f
Opcode Fuzzy Hash: 1ef8c7870e84a240535d71bb138f60a58f479ca8df2d3cd8415f535e9707aa8e
Instruction Fuzzy Hash: D3F18F3160C7818FC715CE29C49436ABFE2BBD9305F188A6EE8D987352D734D949CB92

Function 005513A3 Relevance: 6.6, Strings: 5, Instructions: 390COMMON

Download Yara Rule

Strings

gfff, xrefs: 00551F57
0123456789abcdefxp, xrefs: 005513AD
0123456789ABCDEFXP, xrefs: 005513A3
gfff, xrefs: 00551F3C
-, xrefs: 00551F23

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID: -$0123456789ABCDEFXP$0123456789abcdefxp$gfff$gfff
API String ID: 0-3620105454
Opcode ID: 27da31bc0524d53b9f6021a77cf93b1226eae7ec1d5b12c88463cd8a487d1f86
Instruction ID: 53944605c17d8805c38d7fb00a1bc53245de4e3fc61f1ae35ee09a929f61a3e8
Opcode Fuzzy Hash: 27da31bc0524d53b9f6021a77cf93b1226eae7ec1d5b12c88463cd8a487d1f86
Instruction Fuzzy Hash: FDD19E3560C7818FC719CE29C49426AFFE2BFD9305F088A6EE8D987352D634D949CB52

Function 0071CD19 Relevance: 6.5, Strings: 4, Instructions: 1545COMMON

Download Yara Rule

Strings

CL}, xrefs: 0071D993
*^}, xrefs: 0071D30A
GL}, xrefs: 0071D999
iU~], xrefs: 0071DD93

Memory Dump Source

Source File: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID: *^}$CL}$GL}$iU~]
API String ID: 0-2885990120
Opcode ID: 5bf793a001e9b6ef677d5ea75bf3a8fc4a7939dda8661e31096d07458919a8ee
Instruction ID: 13f10d9cb1bc0f2349d95c352a758feb5fa31daf964cfa29af6cf16bb36c648a
Opcode Fuzzy Hash: 5bf793a001e9b6ef677d5ea75bf3a8fc4a7939dda8661e31096d07458919a8ee
Instruction Fuzzy Hash: 01A238F3A082149FD3046E2DEC8567AFBE5EF94320F1A463DEAC487744EA3598158793

Function 0057FD10 Relevance: 5.7, Strings: 4, Instructions: 667COMMON

Download Yara Rule

Strings

NA_I, xrefs: 0058036D
:, xrefs: 00580087
uvw, xrefs: 0057FE95
m1s3, xrefs: 0057FEC3, 0057FECB

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID: :$NA_I$m1s3$uvw
API String ID: 0-3973114637
Opcode ID: afcac5ef8fe12183066077b572e94a9a8f1349d245e343d8b5c18646fbb5605b
Instruction ID: 1aa930a00cebccfb4531ef3c3e93adb6659ef15071f641bb449d810f6d8eda2b
Opcode Fuzzy Hash: afcac5ef8fe12183066077b572e94a9a8f1349d245e343d8b5c18646fbb5605b
Instruction Fuzzy Hash: 3032BBB0508381DFD311EF28D884A2ABFE5BB9A354F144D1CF9D59B2A2D335D909CB92

Function 00563BE2 Relevance: 5.4, Strings: 4, Instructions: 431COMMON

Download Yara Rule

Strings

;z, xrefs: 00563C87
ss, xrefs: 00563C79
p, xrefs: 00563C80
%*+(, xrefs: 00563EC4

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID: %*+($;z$p$ss
API String ID: 0-2391135358
Opcode ID: 17640c9f97945289ba6daa3f5d6822b18a809f1b2e556cae3869a7e18855761e
Instruction ID: 8531f1a70c1120a0e142c4d05ce166539e1884ac149ae0b2a6af3fffbadbf1a8
Opcode Fuzzy Hash: 17640c9f97945289ba6daa3f5d6822b18a809f1b2e556cae3869a7e18855761e
Instruction Fuzzy Hash: D1026BB4810B00DFD760DF24D986756BFF5FB02301F50895DE89A9B696E331A858CFA2

Function 00572260 Relevance: 5.4, Strings: 4, Instructions: 383COMMON

Download Yara Rule

Strings

hu, xrefs: 0057232F
sj, xrefs: 00572327
a|, xrefs: 00572317
lc, xrefs: 00572507

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID: a|$hu$lc$sj
API String ID: 0-3748788050
Opcode ID: 18cbdfb6213c93aef6a6d29e9a73e63bebbf2257fba3ee338ad14884c2a956fb
Instruction ID: 4baf5976c6a9e24d56307066c32b69230953eadedca2c12b0ccb81a7cbaa36bb
Opcode Fuzzy Hash: 18cbdfb6213c93aef6a6d29e9a73e63bebbf2257fba3ee338ad14884c2a956fb
Instruction Fuzzy Hash: A0A19BB4408341CBC720DF18D891A2BBBF0FF96354F589A0CE8D99B291E339D945DB96

Function 0071E76B Relevance: 5.3, Strings: 3, Instructions: 1569COMMON

Download Yara Rule

Strings

okA, xrefs: 0071EF47
:U}, xrefs: 0071F620
tj%, xrefs: 0071EC5A

Memory Dump Source

Source File: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID: :U}$tj%$okA
API String ID: 0-3059668953
Opcode ID: 5a34cdf0bccd815bab179d5f4bac0a81aac146e2856573511b9e77349a7406b9
Instruction ID: f1b307010c7fa372425bbd9fd21f9f85267bdeb053713e3e38d1dc2aa1b116aa
Opcode Fuzzy Hash: 5a34cdf0bccd815bab179d5f4bac0a81aac146e2856573511b9e77349a7406b9
Instruction Fuzzy Hash: 3BB2D5F360C604AFE304AE29EC8567AFBE9EF94720F16493DE6C4C3744EA3558018796

Function 0057D7AF Relevance: 5.2, Strings: 4, Instructions: 213COMMON

Download Yara Rule

Strings

CV, xrefs: 0057D98B
KV, xrefs: 0057D97D
#', xrefs: 0057D9EA
T>, xrefs: 0057D984

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID: #'$CV$KV$T>
API String ID: 0-95592268
Opcode ID: ee7db918ec0d06e8322c474c7836a62740b3c2215042a2e55132b3625db162bf
Instruction ID: 8589a140cdcb26ba634ac385d89bfaa9ba3a8ec7ffd958d885465120f1f408f2
Opcode Fuzzy Hash: ee7db918ec0d06e8322c474c7836a62740b3c2215042a2e55132b3625db162bf
Instruction Fuzzy Hash: F38146B48017469BDB20DFA5D28555EBFB1FF16300F60560CE8867B655C330AA55CFE2

Function 0057AC91 Relevance: 5.1, Strings: 4, Instructions: 128COMMON

Download Yara Rule

Strings

lk, xrefs: 0057ACBC
,{*y, xrefs: 0057AD07, 0057AD13
4c2a, xrefs: 0057ACA9
(g6e, xrefs: 0057ACA1

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID: (g6e$,{*y$4c2a$lk
API String ID: 0-1327526056
Opcode ID: 450f0196e53d5bbc26c09f6aaa2276f6b1d22fdbd96b1b59e6d5929bc6d83a1c
Instruction ID: 3ca2f2f38bce9134ad2454263684113038b034c1f079d38fcdeb9779b02eaf72
Opcode Fuzzy Hash: 450f0196e53d5bbc26c09f6aaa2276f6b1d22fdbd96b1b59e6d5929bc6d83a1c
Instruction Fuzzy Hash: 3A4198B4408382CBD7209F20D904BABBBF0FF86305F54995DE5C897260EB31D948DB9A

Function 0057C470 Relevance: 4.2, Strings: 3, Instructions: 419COMMON

Download Yara Rule

Strings

%*+(, xrefs: 0057C9E4, 0057C9ED
%*+(, xrefs: 0057C8C3, 0057C8CB
~/i!, xrefs: 0057C537

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID: %*+($%*+($~/i!
API String ID: 0-4033100838
Opcode ID: f13a7e3870c531ca0ce43ef2ddf7b27090f2495a9c89a687a209ce2b30f82732
Instruction ID: 8178ffc9c084524384510852b2ce9f3f805ad49ab4e93d8b24cbc2200bd4af20
Opcode Fuzzy Hash: f13a7e3870c531ca0ce43ef2ddf7b27090f2495a9c89a687a209ce2b30f82732
Instruction Fuzzy Hash: 95E1A6B5518340DFE7209F64E885B2EBBF5FB96340F58882CE6898B251E731D814DB92

Function 00594040 Relevance: 3.1, Strings: 2, Instructions: 577COMMON

Download Yara Rule

Strings

f, xrefs: 0059420C
%*+(, xrefs: 005940A4, 005940AD

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID: %*+($f
API String ID: 0-2038831151
Opcode ID: 52f72266b4212968d5bce3e77fe14bcfe8723f41c35b21e585727f20d3e8d8df
Instruction ID: 6046cb14451cf325ef2e034d54cc8533b68e36993d69a29efe7cb110be5d547f
Opcode Fuzzy Hash: 52f72266b4212968d5bce3e77fe14bcfe8723f41c35b21e585727f20d3e8d8df
Instruction Fuzzy Hash: A8127A716083419FCB15CF18C880A2EBBE6FBC9318F588A2CE4959B291D735DD46CF92

Function 005535B0 Relevance: 2.9, Strings: 2, Instructions: 411COMMON

Download Yara Rule

Strings

NaN, xrefs: 0055360E
Inf, xrefs: 00553607

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID: Inf$NaN
API String ID: 0-3500518849
Opcode ID: 68db808768a10728453c8c3f565c5a58e05e84f3d23ff96200f89c808824c7a7
Instruction ID: 9ab3fcf573cf6d9f38de60a4f059c9180dc973a2601df4b386eb5f9e3c91f664
Opcode Fuzzy Hash: 68db808768a10728453c8c3f565c5a58e05e84f3d23ff96200f89c808824c7a7
Instruction Fuzzy Hash: 87D1E7B1A083119BC704CF68C99061EBBE1FBC8791F158D2EFD9997391E671DD098B81

Function 0056FFDF Relevance: 2.7, Strings: 2, Instructions: 185COMMON

Download Yara Rule

Strings

BaBc, xrefs: 00570197
Ye[g, xrefs: 005700F6

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID: BaBc$Ye[g
API String ID: 0-286865133
Opcode ID: c00072b45f815a84bf79ed25eff2c3ef843f9ec971b0fc69692e182a750aee7c
Instruction ID: 7f32390d6bc31e8a7ea60da54c53594fde84ad067edbe0d7a664b3f91515c0f1
Opcode Fuzzy Hash: c00072b45f815a84bf79ed25eff2c3ef843f9ec971b0fc69692e182a750aee7c
Instruction Fuzzy Hash: 2151CBB1608381CAC331CF14D885BABBBE0FF96320F08991DE4898B691E3749840DB57

Function 00651A5C Relevance: 2.7, Strings: 2, Instructions: 175COMMON

Download Yara Rule

Strings

p_K, xrefs: 00651BA7
6PH/, xrefs: 00651C99

Memory Dump Source

Source File: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID: 6PH/$p_K
API String ID: 0-2579418450
Opcode ID: 74da8b8348c6a47f0480660682b89cf919a8ff0acc49c8ee1e8df531df10a751
Instruction ID: a0128c5d385ba30b49fed7803705d8213405c6b15d4d9addf9873c0afdd839bf
Opcode Fuzzy Hash: 74da8b8348c6a47f0480660682b89cf919a8ff0acc49c8ee1e8df531df10a751
Instruction Fuzzy Hash: 355104F3E046144BE3446E29DD5437ABAD6ABE0320F1B063CCEC997784E93E5D498686

Function 00555160 Relevance: 1.8, Strings: 1, Instructions: 577COMMON

Download Yara Rule

Strings

%1.17g, xrefs: 005554C8

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID: %1.17g
API String ID: 0-1551345525
Opcode ID: 9d538a3cad2ee5b41300581cddb10fbc4a955fb4b7787c279b5cd3577d038e96
Instruction ID: c3ca54a15314dae87be534f404b7752735dafbce275c135f7fa95ad1418b2ba0
Opcode Fuzzy Hash: 9d538a3cad2ee5b41300581cddb10fbc4a955fb4b7787c279b5cd3577d038e96
Instruction Fuzzy Hash: EA22BFB6A08B42CBE7158E189870326BFA2BFA4356F29896EDC594B251F771D80CC741

Function 005812D0 Relevance: 1.7, Strings: 1, Instructions: 484COMMON

Download Yara Rule

Strings

", xrefs: 005815D1

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 1e36e4a90a5bcd9904d9a2755a98640d2f51fe7f53356f7c076c40d918f289ea
Instruction ID: 53f995794ee66d2457209880725b158eaedae10eb11db9ad5b854d87bfa39c02
Opcode Fuzzy Hash: 1e36e4a90a5bcd9904d9a2755a98640d2f51fe7f53356f7c076c40d918f289ea
Instruction Fuzzy Hash: 3AF14771A087414FC724DE24C45562BBFE9BFC1350F18895DEC9AAB382D634DD06C795

Function 0057AE57 Relevance: 1.7, Strings: 1, Instructions: 455COMMON

Download Yara Rule

Strings

%*+(, xrefs: 0057B2D3, 0057B2DB

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: ac528c3ee0d1c1a5166fd5ff0dacf1dfae30a082acb5ed143cc52978eeee7001
Instruction ID: 8067b2cca7ebcfcc1ae0364f183988d0976d5869ac28836a1702da197bbb3956
Opcode Fuzzy Hash: ac528c3ee0d1c1a5166fd5ff0dacf1dfae30a082acb5ed143cc52978eeee7001
Instruction Fuzzy Hash: 5EE1BB75508706CBD714DF28D490A6FBBE2FF99781F548D1CE4C987221E330A999EB82

Function 00566EBF Relevance: 1.7, Strings: 1, Instructions: 447COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00566EF3

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 7ab213035c05cc352305a3f71a4ba136542183447c539d286b9281f9f84ee124
Instruction ID: f863887df1898692d796baf2564be3bf8203963ad56539f2c5c3e837089efebf
Opcode Fuzzy Hash: 7ab213035c05cc352305a3f71a4ba136542183447c539d286b9281f9f84ee124
Instruction Fuzzy Hash: 4DF1BF75600B02CFD724DF24D891A26BBF6FF98315B148A2DE49787AA1EB30F855CB41

Function 00577E60 Relevance: 1.7, Strings: 1, Instructions: 425COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00578263, 0057826B

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: b1b140eb67ed9adb4540abb937dd38692ffe21cf181c249ff39b19081be4b259
Instruction ID: b53fabeec5c0d2e4c1a080a7e0bb13077b7110fa107d94d00c4768c2e7a2cd3c
Opcode Fuzzy Hash: b1b140eb67ed9adb4540abb937dd38692ffe21cf181c249ff39b19081be4b259
Instruction Fuzzy Hash: 53C1CF71508301ABD710AB14E889A3BBBF5FF95354F48881CF8C99B252E734DD05EBA2

Function 00578D62 Relevance: 1.7, Strings: 1, Instructions: 410COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00579233, 0057923B

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 0aeed53c82f64a562cfce7d73dd67b63ae3da4c8539be80f94778897f3f24cf0
Instruction ID: 2394a261f63a539ee9ea9af8eab63fff6b4dcca10c527c0269127261e5961612
Opcode Fuzzy Hash: 0aeed53c82f64a562cfce7d73dd67b63ae3da4c8539be80f94778897f3f24cf0
Instruction Fuzzy Hash: 94D1F171628302DFD704DF68EC90A2ABBE5FF9A310F49886CE886D7291D730E854DB51

Function 00564487 Relevance: 1.6, Strings: 1, Instructions: 389COMMON

Download Yara Rule

Strings

BIV, xrefs: 0056485E

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID: BIV
API String ID: 0-804028465
Opcode ID: adc7031817a590ce97ab0d7f66058a8958085322e2e262994e0bba3c43c51d43
Instruction ID: 08c7e5c8afe88c5a7ef5e0abb52244a9d280c41bd55e884cc487c8523cbd4250
Opcode Fuzzy Hash: adc7031817a590ce97ab0d7f66058a8958085322e2e262994e0bba3c43c51d43
Instruction Fuzzy Hash: 92E110B5501B008FD361CF28D9A6B97BBE1FF46709F04886DE4AAC7B52E731B8148B54

Function 00597FC0 Relevance: 1.6, Strings: 1, Instructions: 387COMMON

Download Yara Rule

Strings

P, xrefs: 00598167

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID: P
API String ID: 0-3110715001
Opcode ID: 315f787e9f35c7cda75898f12fad038b7b34d8f5ed7915a36adc79771099b3ba
Instruction ID: e62217c4717f9d3b981ef46d7a76bff62ed343f4cbc7a913cc24cf0c10ea8945
Opcode Fuzzy Hash: 315f787e9f35c7cda75898f12fad038b7b34d8f5ed7915a36adc79771099b3ba
Instruction Fuzzy Hash: 2FD1F7729082614FCB25CE18D89072EBBE1FB85758F168A2CE8B5AB390DB75DC05C7D1

Function 00596CBF Relevance: 1.6, Strings: 1, Instructions: 384COMMON

Download Yara Rule

Strings

"pY, xrefs: 00597015

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID: "pY
API String ID: 0-4177582906
Opcode ID: 114fd1553ae3de231107c23899e113e87421d670b3004d95937aa2ee0dc7d89c
Instruction ID: 2c336741fbdd4cd18cbea74904df9c07a017c92f4e75adb060739f296d536735
Opcode Fuzzy Hash: 114fd1553ae3de231107c23899e113e87421d670b3004d95937aa2ee0dc7d89c
Instruction Fuzzy Hash: BDD1E036618351CFCB10CF38D89052ABBE2BF9A354F094A6DE891D73A1D330DA48DB91

Function 0057CCD0 Relevance: 1.6, Strings: 1, Instructions: 357COMMON

Download Yara Rule

Strings

%*+(, xrefs: 0057CDC3, 0057CDCB

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID: InitializeThunk
String ID: %*+(
API String ID: 2994545307-3233224373
Opcode ID: daf27393b56108e7e512a9596ed77068f9574b88bcaadc36b1cd8f203bb61a90
Instruction ID: 06ddaf23844978541e9b523fe7418172dea742696bfc89a89cbeb82e8a9bd92a
Opcode Fuzzy Hash: daf27393b56108e7e512a9596ed77068f9574b88bcaadc36b1cd8f203bb61a90
Instruction Fuzzy Hash: 2EB1DF705093019BD714DF14E884A2BBFF6FF95340F14892CE9C99B252E335E855EBA2

Function 0058FC20 Relevance: 1.5, Strings: 1, Instructions: 265COMMON

Download Yara Rule

Strings

%*+(, xrefs: 0058FCA4, 0058FCAD

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 93901e139ce9b6378753d1d6308f0f7baadfa122660ba15ff82f663b0dcd6826
Instruction ID: 43a72dc404d9b80303b4253aa575a01d3eba050a709083acf79aefa9cf97cefc
Opcode Fuzzy Hash: 93901e139ce9b6378753d1d6308f0f7baadfa122660ba15ff82f663b0dcd6826
Instruction Fuzzy Hash: 6F81D071109301EFD710EF58D885B2EBBE5FB9A745F04882CFA85A7251E730E918DB62

Function 0056D457 Relevance: 1.5, Strings: 1, Instructions: 248COMMON

Download Yara Rule

Strings

%*+(, xrefs: 0056D663, 0056D66B

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: c67ed0fa9a1a0cafc40c6e44738586f9b9c28d4b199d67a20fe805d023853956
Instruction ID: c520259f1326b2ab37affb1a0f16de309673314193fef8d9a8fc7408f2b66e88
Opcode Fuzzy Hash: c67ed0fa9a1a0cafc40c6e44738586f9b9c28d4b199d67a20fe805d023853956
Instruction Fuzzy Hash: 9B61C272A04305DBD710AF18DC92A7ABBB1FFA5354F08092DF9868B391E731D915C7A2

Function 00594A40 Relevance: 1.5, Strings: 1, Instructions: 220COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00594C33, 00594C3B

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: c3fafcd88092cf704217ca81eee4261fd92d910699b2c5f799ab78b18e85542b
Instruction ID: 008f0f12fa9206641dfec66c8495f477f105e87fb345f74b35ccfe1748118a88
Opcode Fuzzy Hash: c3fafcd88092cf704217ca81eee4261fd92d910699b2c5f799ab78b18e85542b
Instruction Fuzzy Hash: 1061AB716093419FDF119F25C880F2ABBE6FB95314F18891CE989872A2D731EC52DF92

Function 00722D66 Relevance: 1.5, Strings: 1, Instructions: 208COMMON

Download Yara Rule

Strings

Vf?o, xrefs: 00722FB0

Memory Dump Source

Source File: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID: Vf?o
API String ID: 0-111898117
Opcode ID: 04184aa17af58b7afacffd182ceb9a2c168d4f6fbb4399a7cd7047b5dbab3325
Instruction ID: 9412f2144a263d485ce7043b1afb3a14ea3432b9bfdeec9c64d65d7217a04281
Opcode Fuzzy Hash: 04184aa17af58b7afacffd182ceb9a2c168d4f6fbb4399a7cd7047b5dbab3325
Instruction Fuzzy Hash: 615137F39092009FD3046E2EDC4156AFBEAEFD4621F1A863DEAC983758E93158058692

Function 0055E1A0 Relevance: 1.4, Strings: 1, Instructions: 175COMMON

Download Yara Rule

Strings

000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F8081, xrefs: 0055E333

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID: 000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F8081
API String ID: 0-2471034898
Opcode ID: a2e704d2f9d09b24ef8ecd8e2d3e97f14c827c878f3542046d2f18b7933c9ee1
Instruction ID: d3214f7d64b752bdced3d3a604d72189630ea6e3904c9c0ea7ee0101cee13da7
Opcode Fuzzy Hash: a2e704d2f9d09b24ef8ecd8e2d3e97f14c827c878f3542046d2f18b7933c9ee1
Instruction Fuzzy Hash: 4A516837A0D6904BD32C893C4C622696E871BE2334F3ECB6BEDF58B3E4D51549089390

Function 00593920 Relevance: 1.4, Strings: 1, Instructions: 172COMMON

Download Yara Rule

Strings

%*+(, xrefs: 005939E3, 005939EB

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 29ea3876e1e0e1473db8d7771ab9cc6d317d326cf614157445ffd4f4b80a2a9e
Instruction ID: f2845c2f24392a90b08e220f22ec56a292bb665cd63d182906f5531ac89903ca
Opcode Fuzzy Hash: 29ea3876e1e0e1473db8d7771ab9cc6d317d326cf614157445ffd4f4b80a2a9e
Instruction Fuzzy Hash: 48518A34609240DBCF24DF19D884A2EBFE6FB86744F18881CE4C697262E371DE14DB62

Function 00561BEE Relevance: 1.4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

Strings

L3, xrefs: 00561C3E

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID: L3
API String ID: 0-2730849248
Opcode ID: 6daf727106ff7f019dc0e2982b9e4fc90ca47834c265ff8f06663ccd05f978ca
Instruction ID: 3ef689973bd3423484d32e7583c1203cda6b94c40e19ec2427d62ef960be09a7
Opcode Fuzzy Hash: 6daf727106ff7f019dc0e2982b9e4fc90ca47834c265ff8f06663ccd05f978ca
Instruction Fuzzy Hash: AC4152B44083809BD7149F64D894A2FBBF0BF9A354F08891DF5C59B291D736C905CB5A

Function 0058FF70 Relevance: 1.4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00590033, 0059003B

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: fde4540a11174b0cb482954f99411aa927d151a4da13ac63210e13fa38a2961f
Instruction ID: 0febd938b255d1a7d6bb66f96e8107c17efb2e2717f586c97e2e231c66a6fd6e
Opcode Fuzzy Hash: fde4540a11174b0cb482954f99411aa927d151a4da13ac63210e13fa38a2961f
Instruction Fuzzy Hash: 3D31D2B5908301AFDE10EA14DC89B2BBFE9FB85744F945C28F88597292E221DC14C7A2

Function 0057E40C Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

72?1, xrefs: 0057E6A2

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID: 72?1
API String ID: 0-1649870076
Opcode ID: 7eb6754bb046c7d645eac00ec5959a512b3286c6cb9f7a1302eca9387925de2e
Instruction ID: 5dedf695b519ba8fb570acf83f14f04c52b0ad60b215532c56d6c591aebf0440
Opcode Fuzzy Hash: 7eb6754bb046c7d645eac00ec5959a512b3286c6cb9f7a1302eca9387925de2e
Instruction Fuzzy Hash: F03104B5900745CFCB20DF94E8915AFBFB4FB5A345F144869E44AAB301D331AD08DBA2

Function 00566F91 Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

%*+(, xrefs: 0056703B

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: a7cdaddbd2040f1ad921c52cfc3a293bf8f5f65bc6a1a6027900a18afdbbbe07
Instruction ID: 8ced67fbd831550f35c7a40a23cce7f1807adf986e30544848482851ab45ea98
Opcode Fuzzy Hash: a7cdaddbd2040f1ad921c52cfc3a293bf8f5f65bc6a1a6027900a18afdbbbe07
Instruction Fuzzy Hash: CF415971204B08DBD7348B61C998F26BBF2FB4D704F248818E5869B6A1E331F8008F20

Function 0057E66A Relevance: 1.4, Strings: 1, Instructions: 100COMMON

Download Yara Rule

Strings

72?1, xrefs: 0057E6A2

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID: 72?1
API String ID: 0-1649870076
Opcode ID: f03049656b48856228414261681ef80b0a0effda08d49b75a8796093238b4f86
Instruction ID: 715beb96902a6624acc04df0e20d4af15a43989f22798d23bb5176de99ced6ac
Opcode Fuzzy Hash: f03049656b48856228414261681ef80b0a0effda08d49b75a8796093238b4f86
Instruction Fuzzy Hash: DB21ECB5900745CFCB20CF94E89196FBFB4FB5A345F144858E44AAB301C331AD08EBA6

Function 00632B37 Relevance: 1.3, Strings: 1, Instructions: 99COMMON

Download Yara Rule

Strings

EQwq, xrefs: 00632B41

Memory Dump Source

Source File: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID: EQwq
API String ID: 0-2811010319
Opcode ID: 46264920b29010630541202fb3d82708d3b361e0fc2a4d714c3d79f114ae1b8d
Instruction ID: e1cc0d25a6e6ff9dfb26af4a14cea98ee618567eb6e40b2536be2e66e5192b3a
Opcode Fuzzy Hash: 46264920b29010630541202fb3d82708d3b361e0fc2a4d714c3d79f114ae1b8d
Instruction Fuzzy Hash: DB31E2F3D182244BF3246A29DC8576AFB95AB94714F1F823D9F98677C0E93C5C1482CA

Function 00599CE0 Relevance: 1.3, Strings: 1, Instructions: 87COMMON

Download Yara Rule

Strings

@, xrefs: 00599D30

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: e26ab31d0385f46894aacbe39f2f568a259599f5793a4767f894a3dbf9b9ce95
Instruction ID: aaa6eb6e4c18b4a90f391f68d054aa741e476450815c6a705b6537ad8dc4fc84
Opcode Fuzzy Hash: e26ab31d0385f46894aacbe39f2f568a259599f5793a4767f894a3dbf9b9ce95
Instruction Fuzzy Hash: CE3189705093009BDB10DF19D880A2BFBF9FF9A354F54892CE5C597251E335D904CBA6

Function 00564E2A Relevance: 1.0, Instructions: 957COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df517ad2e44ee0edbe42d6ebcbade2bd9f7fc76f4d3b4629da19bd2194fd86ff
Instruction ID: c7155f80c36acd45dc4bc85298a1512a8a98a8a038236a3e9973bf49edb5a287
Opcode Fuzzy Hash: df517ad2e44ee0edbe42d6ebcbade2bd9f7fc76f4d3b4629da19bd2194fd86ff
Instruction Fuzzy Hash: E16256B0600B418FD725CF24D894B27BBF6BF5A714F54892DD49B8BA52E730E848CB91

Function 0055BEB0 Relevance: .9, Instructions: 895COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30cb9a533554be97e06675d3460cdff0be9d55b2c6c1132c24f0b6137cc6b4a7
Instruction ID: 2caaad8e160d7c0699fb79674e9681dc9df3ca2f202df8853dbdd5cb9f20b840
Opcode Fuzzy Hash: 30cb9a533554be97e06675d3460cdff0be9d55b2c6c1132c24f0b6137cc6b4a7
Instruction Fuzzy Hash: 94522A315087118FC725DF18D4642BABBE1FFC531AF254A2EDDC697280E734A859CB86

Function 00598652 Relevance: .7, Instructions: 710COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8c60f9e43ae254600915dfdace167d8c615161af652c8c2b4194e6c12b7acec
Instruction ID: 0626a8d6172d3cd7a3818a82fa1f0d0f0dd621a088dbe47b33a3195526b065a4
Opcode Fuzzy Hash: d8c60f9e43ae254600915dfdace167d8c615161af652c8c2b4194e6c12b7acec
Instruction Fuzzy Hash: D322CC35608341CFCB04DFA8E89062ABBE1FF9A315F09886DE58987351D775E854DF82

Function 005986F0 Relevance: .7, Instructions: 681COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fd2327501b359ca221158319e67225ad262f6b081962a3c4432ffdd58551f94
Instruction ID: f22b0f1766e1a4e8696c6650d095692fe09f1774b68c60e738b332ceaacb758a
Opcode Fuzzy Hash: 5fd2327501b359ca221158319e67225ad262f6b081962a3c4432ffdd58551f94
Instruction Fuzzy Hash: 8522A935608340DFCB04DFA8E89062ABBE1FF9A305F09896DE58987361C775E854DF92

Function 0055B3A0 Relevance: .7, Instructions: 670COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 852509d1b7bdfd041950b667d464a39bd0ca18ebcf85aa2d700a8832bb71c98e
Instruction ID: b5e15acfd7f6cd6ecdbe7fd1ef75f2ddba28c612ab53447f0606407a0635ce03
Opcode Fuzzy Hash: 852509d1b7bdfd041950b667d464a39bd0ca18ebcf85aa2d700a8832bb71c98e
Instruction Fuzzy Hash: 1452B370908B848FF735CB24C4A83A7BFE2FB95315F144C2EC9D606A82D779A889C755

Function 005571F0 Relevance: .7, Instructions: 657COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 895b682a95eadcb34711752682ace31f68f229f065fa0a78b6938ef231db3758
Instruction ID: 2423682fb881c28616cc55855a6f9326317ab341a5c322e55f6b48d260f07f98
Opcode Fuzzy Hash: 895b682a95eadcb34711752682ace31f68f229f065fa0a78b6938ef231db3758
Instruction Fuzzy Hash: D352C13150C3498FCB15CF29D0A06AABFE1BF88315F198A6EEC9957342D734E949CB81

Function 00558FD0 Relevance: .6, Instructions: 620COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0f95a4762171133150b17ce63b34cce65f8dd781a8bcc9323d1ee52ee14c4db
Instruction ID: 5ddb18cc083693ba1340390e9a13527928fca88477ca45a39822aa44d4beca26
Opcode Fuzzy Hash: c0f95a4762171133150b17ce63b34cce65f8dd781a8bcc9323d1ee52ee14c4db
Instruction Fuzzy Hash: 92426875608301DFDB04CF28D86175ABBE1BF88315F0A886EE88987391D739D949DF82

Function 00557BF0 Relevance: .6, Instructions: 592COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f3d28d75f289d22c7d1d282a420fb5222e22e9e6016f6935fd744c851cfd78c
Instruction ID: 17e3fa3211566bf3cf1f461d4eda0dd4848c8fda939a2e6954a3046fc9e6d52d
Opcode Fuzzy Hash: 2f3d28d75f289d22c7d1d282a420fb5222e22e9e6016f6935fd744c851cfd78c
Instruction Fuzzy Hash: 62322470514B158FC368CF29C5A052ABBF1BF49711BA04A2EDAA797F90D736F849CB10

Function 005989A0 Relevance: .5, Instructions: 545COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a1bbe3521ae5c4b83d883c9e8d0c15195755ad173403cb63b8a0acc74809cca
Instruction ID: 3b64cceb74e39a71ce7a23410391bfc74af34b2d7f9c979ca3107c950088bfb0
Opcode Fuzzy Hash: 3a1bbe3521ae5c4b83d883c9e8d0c15195755ad173403cb63b8a0acc74809cca
Instruction Fuzzy Hash: 4B029835608341DFCB04DFA8E88062EBBE1FF9A305F09896DE58987261C776D854DF92

Function 00598A80 Relevance: .5, Instructions: 524COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c4ffb50e0cfd8e79001b8b578d53a5f0c683e4207580c2dff18c60e100cff83
Instruction ID: 71ee42327340f783f38fb979f1ff4d9a35fc729348b75ad298c1374f76155526
Opcode Fuzzy Hash: 8c4ffb50e0cfd8e79001b8b578d53a5f0c683e4207580c2dff18c60e100cff83
Instruction Fuzzy Hash: 79F18635608381DFCB04DF68E88062EBBE1FF9A305F09892DE4C987252D736D954CB92

Function 00598C02 Relevance: .5, Instructions: 487COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f539e26fea9441417163f4ea8de7028412a6111f090a8962741cdafd12b29039
Instruction ID: 223ffc52aec52115a54e86464f5e6163067299aa3cf05cf98a6d971f6b1e693b
Opcode Fuzzy Hash: f539e26fea9441417163f4ea8de7028412a6111f090a8962741cdafd12b29039
Instruction Fuzzy Hash: 05E1BB35608341CFCB04DF68E88062ABBE2FF9A315F09896DE49987351D776E814CB92

Function 0055A300 Relevance: .5, Instructions: 459COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dbf8a9190905fd82ba4d34b3568b61c3c587483ba5650872ac470c2db95d517
Instruction ID: f82c5705639d2d4dd89e4863ba9a8c38a4c9b72a954153b21aac04127462678f
Opcode Fuzzy Hash: 8dbf8a9190905fd82ba4d34b3568b61c3c587483ba5650872ac470c2db95d517
Instruction Fuzzy Hash: C6F1AD756083418FC724CF29C89166BBFE2BFD8304F08892EE9D587752E635E949CB52

Function 00598E70 Relevance: .4, Instructions: 420COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe2cb7193ae127e070984632d6fb4d132ad76575dcc5fabd66d847281025cc19
Instruction ID: e0fa88712b471ff9bbf2da3c9aeb988b1633def1b6e240505c4c5c6e32f6d8e0
Opcode Fuzzy Hash: fe2cb7193ae127e070984632d6fb4d132ad76575dcc5fabd66d847281025cc19
Instruction Fuzzy Hash: 0FD18634608280DFDB04EF68E89062ABBE5FF9A305F09896DE4D587252D736D814DB92

Function 00597AB0 Relevance: .4, Instructions: 354COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b185aefcb47b3fcde6b3f074c18886fec67e115535b9b0c6ec1fa9a7827636a
Instruction ID: 8bf29b3ea875a9a4e1fadb8424b5af420360e5e412a3fbae982a02408a571463
Opcode Fuzzy Hash: 8b185aefcb47b3fcde6b3f074c18886fec67e115535b9b0c6ec1fa9a7827636a
Instruction Fuzzy Hash: AEB12572A1C3544BEB14DA28CC4576BBFE9FBC9314F08492EF99997382E635DC048792

Function 0055AF10 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c6117061885288c1b39a5b943f8482e52345fd8b1a48c2f17ef7dcb0cf10c7c
Instruction ID: 657b321b48d4dc37367a7f254d53eab473219863a96ddf29f4e2a861dbf913b2
Opcode Fuzzy Hash: 9c6117061885288c1b39a5b943f8482e52345fd8b1a48c2f17ef7dcb0cf10c7c
Instruction Fuzzy Hash: A1C18F71A087418FD360CF28CC9A7ABBBF1BF85318F08492DD5D9C6242E778A155CB06

Function 00566536 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3edef897169b322d68ec2ea2024b282acbc85f4309fffd53c5fc9c5ad3ac82e2
Instruction ID: c15617b4a070f84e0a9bbd5108a0651220cb7b9385f87c88e2f1a3d95fdea982
Opcode Fuzzy Hash: 3edef897169b322d68ec2ea2024b282acbc85f4309fffd53c5fc9c5ad3ac82e2
Instruction Fuzzy Hash: C6B10EB4600B408BC3218F24D995B27BBF2BF56705F14885DE8AA8BB52E735F805CB95

Function 00597710 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 54d7cc38d70e2ed721db01f6ffb086c8681946170bc86a6788f4203fb60c8f57
Instruction ID: f3e5adec9ff91f9e845ef3e25157ec3914245540680f93ed43c6650a0a613ea3
Opcode Fuzzy Hash: 54d7cc38d70e2ed721db01f6ffb086c8681946170bc86a6788f4203fb60c8f57
Instruction Fuzzy Hash: 8291AE7161C305ABEB20DB14C845BAFBBE6FB89354F54881DF48997352E730E940CB92

Function 0059A0D0 Relevance: .3, Instructions: 282COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1c46d3656585cc87fc91b7e5ffcdde64e1e0019a6163b469dc8b537015c7e87
Instruction ID: 2403608fc20a141af994842b4691c18f35ce2f2ff2430351b6bb8442ef2c2f66
Opcode Fuzzy Hash: b1c46d3656585cc87fc91b7e5ffcdde64e1e0019a6163b469dc8b537015c7e87
Instruction Fuzzy Hash: 2B817F342087019BDB25DF28D890A2EBBF5FF99740F55892CE586C7261E731EC51CBA2

Function 005864F0 Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f41f6c0f3ddadf08819315592cc8eaba1bca0ee2c68c044d7331c23e98d0cf2
Instruction ID: 05a332826d1b1a8cba6af4de97f797ceede18c46835c72b38e33f249d8f39cd1
Opcode Fuzzy Hash: 4f41f6c0f3ddadf08819315592cc8eaba1bca0ee2c68c044d7331c23e98d0cf2
Instruction Fuzzy Hash: FC711833B29A904BC314AD7C4C42395AE436BE6334B3EC779EDB4DB3E5D62948065391

Function 005728E9 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fc752aaee63cd988754d4368ff7800bd996d8c02115451104265a7dd602a5e6
Instruction ID: 2569706c8b366625bae81a23a866e649a7c7c57a9bda5fc7ab9adc847d605939
Opcode Fuzzy Hash: 9fc752aaee63cd988754d4368ff7800bd996d8c02115451104265a7dd602a5e6
Instruction Fuzzy Hash: B16189B44183508BD310AF14E851A2ABBF0FFA2755F04891DE4C98B362E33AC914DB67

Function 00577C00 Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60e2deee1e40ab1c898af8a68d696a951ca774dd179036dc15b640868a96135f
Instruction ID: 521e54ad7b184ad9c98f0288ba294b4d358eb8359789c8b2c700e99a32191405
Opcode Fuzzy Hash: 60e2deee1e40ab1c898af8a68d696a951ca774dd179036dc15b640868a96135f
Instruction Fuzzy Hash: 1C51B0B16083089BDB209B24EC96B773BB8FF89354F148958F9898B291F375DC05E761

Function 006C197A Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efeae3ddb2104e66ff318f1fa1e97e105e40b5bb49e2c9ffcaf060b874a93eaf
Instruction ID: 44cecb43bc4c575d6016e6b0b5be798a161950af856fe5509bb3fb43435c1dd3
Opcode Fuzzy Hash: efeae3ddb2104e66ff318f1fa1e97e105e40b5bb49e2c9ffcaf060b874a93eaf
Instruction Fuzzy Hash: DE8135F3A082149BE3086E39DD4572BBBE6EFC0720F168A3DE5C997784DA354945C682

Function 006F37B2 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 070609d4fc78744354c127d44570928770bc1bf453c1d03c19de8417c2bda3ae
Instruction ID: cb3c58492ff526968f376e775144e47607792f7f01645412596cadee674670f4
Opcode Fuzzy Hash: 070609d4fc78744354c127d44570928770bc1bf453c1d03c19de8417c2bda3ae
Instruction Fuzzy Hash: 1A61D5F3A0C6009BF3146E28DC8577AB7E5EB94320F174A3DDBD487780EA7958448686

Function 00581860 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d108e008403b3c92b59985e25fae4eb0cb21936506a5ffd7efe5999b9cc5533
Instruction ID: cbf912c118243e9e7c799ebdd93b07637f9efa3738d895f27eb79376e396d5d3
Opcode Fuzzy Hash: 6d108e008403b3c92b59985e25fae4eb0cb21936506a5ffd7efe5999b9cc5533
Instruction Fuzzy Hash: E561D53160D7019BD718EE28C58072FBFEABBC5750F64C92DE889AB351D270DD429B89

Function 005882D0 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95a52bed1337cd9228537bc7f67229a7c9a26d9c7be8e9f0ee6f24b5e156f56c
Instruction ID: 031a6aeb7de66f297a8b7e2904f81910d544418b3a27b2684503ba7fc79664fe
Opcode Fuzzy Hash: 95a52bed1337cd9228537bc7f67229a7c9a26d9c7be8e9f0ee6f24b5e156f56c
Instruction Fuzzy Hash: 29616A33A5A9904BC314653C5C453B66E83ABE2334F7ECB6ADCB1AB3F4CD6948055341

Function 0068E5B1 Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 118fd07021e85e41fdad36af9dafa27dfb5ed662510d71788563ed5dc7b8b322
Instruction ID: d7965db7fdf03ac81e2b438c3dc25d0abf20c69b1aee02f78a0dfa95c14b6dcd
Opcode Fuzzy Hash: 118fd07021e85e41fdad36af9dafa27dfb5ed662510d71788563ed5dc7b8b322
Instruction Fuzzy Hash: 1861F8F3A082109BF304AE69EC857AAF7D6EF94320F1B453CDAC897780D67958458787

Function 005642FC Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b97d3b71c45424bd6b21fe9060bdb41bf1d2b4afa503d4724014e77b54babb6b
Instruction ID: e713eb6ac7cfea1ebad91f0ee6be3d61e1318ed3beac947cfa194d424bc0ed76
Opcode Fuzzy Hash: b97d3b71c45424bd6b21fe9060bdb41bf1d2b4afa503d4724014e77b54babb6b
Instruction Fuzzy Hash: FA81E1B4810B00AFD360EF39D947757BEF4BB06201F404A1EE8EA97695E7306459CBE2

Function 0058E8A0 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53adb1b22930f8a695f789fdc3f4b943ccd6ac5fb5c634955e3c1cdf4e3fec6a
Instruction ID: 5953312b13a1c353f4f53d6ed6250cc9d922857fd70afe37519ebaeb65bf7645
Opcode Fuzzy Hash: 53adb1b22930f8a695f789fdc3f4b943ccd6ac5fb5c634955e3c1cdf4e3fec6a
Instruction Fuzzy Hash: 93517CB16087548FE714DF69D49535BBBE1BBC9318F044E2DE4E983350E379DA088B82

Function 00597520 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54f06d5628f9e55d7a27bb3493aca7d0455d9387d9673750e5c9737c13efbb09
Instruction ID: 0fa9d846a25ff941c8e0d367eefe72cb2de53b2a9068f5fe4dd3e53d3265e799
Opcode Fuzzy Hash: 54f06d5628f9e55d7a27bb3493aca7d0455d9387d9673750e5c9737c13efbb09
Instruction Fuzzy Hash: 7B51F73161C2149BCB159E18CC90B3EBFE6FB8A354F688A2DE8D997391D731EC148791

Function 00555A50 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91d9873307c2a6d97d7ec5cae92fb1d0f03cb238241b9ea4a32f26b83b96bc4c
Instruction ID: 9afc389bffc5ef6bce0e035ac3c7a1feac96c673d4f4d988b98c095eda6ad078
Opcode Fuzzy Hash: 91d9873307c2a6d97d7ec5cae92fb1d0f03cb238241b9ea4a32f26b83b96bc4c
Instruction Fuzzy Hash: 5E51D171A047059FC714DF14C8B0926BBA0FF85326F59466EFC9A8B352E630EC46CB92

Function 005BCAAB Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bce2da23bba4301db03d93b6831597efe6d4522c167b20b7b6ff29fbcfbdf60
Instruction ID: aa90b0abf78650fd7cdcb81e9b749ac2e10acb8656e6159224e9608db2fcf90b
Opcode Fuzzy Hash: 8bce2da23bba4301db03d93b6831597efe6d4522c167b20b7b6ff29fbcfbdf60
Instruction Fuzzy Hash: DA413BF3A092005FE310AE29DCC076BF7EAEBD4620F27C53DEAD497744EA3548058682

Function 006BC95F Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68ea26eaa2dc0ae3afd6d14fa8c393d732c406df8ee45a7a4242e60ee6e0f6b8
Instruction ID: 9b1ae797def477e59695ce76d5f8b5d8d938c6749132154812ae7bf663304055
Opcode Fuzzy Hash: 68ea26eaa2dc0ae3afd6d14fa8c393d732c406df8ee45a7a4242e60ee6e0f6b8
Instruction Fuzzy Hash: 1151A2F2A083049FE754AF2DD88473AF7E5EF84710F16853DDAC987684EA3868548786

Function 0057EC48 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c0b04e37f2bd3c8d7b940b30605e28f23ab87245c96c671459a45b7c2231649
Instruction ID: d436b2563f10bf8a10cbca4402e135841ba32fb755d215f2ded0ce7cf233e668
Opcode Fuzzy Hash: 9c0b04e37f2bd3c8d7b940b30605e28f23ab87245c96c671459a45b7c2231649
Instruction Fuzzy Hash: 8941A178900316DFDF208F54EC91BAEBBB0FF0A344F144588E945AB3A1EB389951DB95

Function 00599B60 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc1a6c2913589e2709a713ce79ff5e630032071291dc0a85e14b6d2c1ab4e7ad
Instruction ID: a649d767ac3cb8a42ae3a3f9ff43f777d2c2d2958eb4272a593f73a2d387fc0b
Opcode Fuzzy Hash: dc1a6c2913589e2709a713ce79ff5e630032071291dc0a85e14b6d2c1ab4e7ad
Instruction Fuzzy Hash: E9419134208300ABDB10DB19DD90B2FBBEAFB95754F54882CF58A97251D335EC10DBA2

Function 00562030 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68416f0a6f87b2d379f7786f686d19932336c8feb248b484370e6da8d5805ff3
Instruction ID: eb3bd15b8b9d2df5a8dd507e153455ea8b8de71f8d4496c2b2247b2cb446be71
Opcode Fuzzy Hash: 68416f0a6f87b2d379f7786f686d19932336c8feb248b484370e6da8d5805ff3
Instruction Fuzzy Hash: 9441F632A0C7654FD35CCE2A849423ABFE2ABC5310F09862EE4D68B3D1DA758945D781

Function 00561E93 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d795d7be3958acf8e94665d3e0853a3f8ee8b34c5b79ff439522536b89566afe
Instruction ID: e53804027037b81d7eedee892d46ce2c4620342a4c0a436b9af1439866a6c9e6
Opcode Fuzzy Hash: d795d7be3958acf8e94665d3e0853a3f8ee8b34c5b79ff439522536b89566afe
Instruction Fuzzy Hash: 6941E174508380ABD320AB54C888B2EFBF5FB96345F144D1DF6C497292C376D814CB6A

Function 00598D8A Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7972189733ac5539eb5b5b6ef597db8dd739ae88a710000c6a00ab03eb800de6
Instruction ID: a2c2eb0c9d8d5593592435e548f23acbe75a0734ca683b2ef872c00fc9427b78
Opcode Fuzzy Hash: 7972189733ac5539eb5b5b6ef597db8dd739ae88a710000c6a00ab03eb800de6
Instruction Fuzzy Hash: 61419D316083518BCB04DF68C49052EFFE6AF9A300F198A2DE4D5DB2A2DB75DD058B82

Function 0056D961 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffa7e8e9806168f0a6859b1e269883a903540ef0ccf8c0bbfd9580fabd24b701
Instruction ID: e1e5519e61bab9aaafd24043eb9b231ca85a18e36845ab0d515c2733969b1010
Opcode Fuzzy Hash: ffa7e8e9806168f0a6859b1e269883a903540ef0ccf8c0bbfd9580fabd24b701
Instruction Fuzzy Hash: 2541BFB1A083818BD7309F14C845BAFBBB0FFA6365F044959E48A8B791E7744940DB63

Function 0058F030 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5be6113664422e96713363ec41851647c31506b086c17a8b3ff98e201e465e1
Instruction ID: 28fa091ace3d25a7b4337235aa76b95e44756b6e3b9ea45c3c2c69cbe0beaaf6
Opcode Fuzzy Hash: c5be6113664422e96713363ec41851647c31506b086c17a8b3ff98e201e465e1
Instruction Fuzzy Hash: B92137329082248BC324AB19C88553BFBE4FB9D704F16863EDCC4A7296E3359C10C7E1

Function 005967EF Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5da224a24dcde6007936aafb5f6d6592a2b3861522f4dd9c531fae6c10f90644
Instruction ID: cd64d3949754885d79050daf4a920da885e6a8a4d0532d51e97c3dfe1148126c
Opcode Fuzzy Hash: 5da224a24dcde6007936aafb5f6d6592a2b3861522f4dd9c531fae6c10f90644
Instruction Fuzzy Hash: 363104705183829ADB14CF14C49062FBFF0BF96788F54580DF4C8AB262D338D989CB9A

Function 00575E70 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b23216e90df576957a3fb2ee2d5d1bf8bcf13811818c440999c7f2c01f3bf5c
Instruction ID: d772adf35d31a7d621df43f190f90bc75a7acfda872dab12197481cd3abf3b46
Opcode Fuzzy Hash: 6b23216e90df576957a3fb2ee2d5d1bf8bcf13811818c440999c7f2c01f3bf5c
Instruction Fuzzy Hash: 3321D1B05086018BC310AF28D84592BBBF8FF92764F44891CF4D98B292F374C904EBA3

Function 005549A0 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbe2eee255ce80e2df90ed4850d7395439c2c852be5922ee4a7cea5853ec6c97
Instruction ID: 51b337053b280b9153702af546c46f6668172c03284466dc0ff804823cba4302
Opcode Fuzzy Hash: cbe2eee255ce80e2df90ed4850d7395439c2c852be5922ee4a7cea5853ec6c97
Instruction Fuzzy Hash: CA31E9316482019BC7109E58D8A153BBBE1FFC431EF18892EEC9A87241D231DCC6CF46

Function 005964B8 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbd1c3a94a5fcf5eedd0b7280b81dc81508f66540b7b89301b7081366c347577
Instruction ID: af8075d6416a704d4d3ae3f15b3223dc28f3dd5c21d1b4628082c936df9ba91e
Opcode Fuzzy Hash: bbd1c3a94a5fcf5eedd0b7280b81dc81508f66540b7b89301b7081366c347577
Instruction Fuzzy Hash: 6C214A7450C2419FCB04EF59D580A2EFBE5FB96785F18881CE4C993362D335A858DB62

Function 0058B650 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: 769e7f68c823d453bb7fe47085f8327a250ebda17b2f3e346bb4393f3a86ca1b
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 6B11E933B051E40ED3169D3D8440575BFA72AA3234B6D4399F8B4AB2D2E7238D8A8354

Function 00580B80 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90022ddfb32469098a8610d4b68e70bc315f5b0e8987f5b71d64abe4c0da561b
Instruction ID: d35b61285751e4197a6a98c58dfd93ba8103b9515bf4f78df111378a1c74a9a7
Opcode Fuzzy Hash: 90022ddfb32469098a8610d4b68e70bc315f5b0e8987f5b71d64abe4c0da561b
Instruction Fuzzy Hash: F90180B1A003024BE660AE10D8E5B3BAEA8BB80719F08552DDC4667381DB71EC0CC791

Function 0057D1E1 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e69718d0978efbed574f8b372ab3b9d1a3ddd01dd58130f5a65e62c32862d9d
Instruction ID: 64b527443dce489d60a7db4a0c7cf6dff5c57133c4442c3d7af8528c5a2937ec
Opcode Fuzzy Hash: 5e69718d0978efbed574f8b372ab3b9d1a3ddd01dd58130f5a65e62c32862d9d
Instruction Fuzzy Hash: 9411DDB0408380AFD3109F618488A2FFBF5ABA6754F148C0DE5A49B251C375D819DF56

Function 00556EA0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83883a623eca2c758e8ff4af1d8bb512456166cf02bf6eb0b0cf10d872a6d577
Instruction ID: 9ec5f3010d03322a5df4ff66d2172b46b1c75a6734ab4cadbb544243c60513f0
Opcode Fuzzy Hash: 83883a623eca2c758e8ff4af1d8bb512456166cf02bf6eb0b0cf10d872a6d577
Instruction Fuzzy Hash: DAF0503EB1920A0B7210CDAAF884837F7D6EBD5765B05153AEE41C3205CD71F80951D0

Function 0058B8C0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dad40b8a8b0cf0c680be38028a9801f4e1e9da1297b4f3b9e1d9df466e9bee7e
Instruction ID: 6506d07c58c905065930edc77b6421f51c28c54387ea28b09faa2761b04cb969
Opcode Fuzzy Hash: dad40b8a8b0cf0c680be38028a9801f4e1e9da1297b4f3b9e1d9df466e9bee7e
Instruction Fuzzy Hash: 1E0162B3A199610B8348CE3DDC1156BBAD15BD5770F19872DBEF5CB3E0D230C8118695

Function 0056C5F0 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8ebd7708255391ffa87ed53dd5dbf97c7cff7b52fcdad9dabb06971c835301f
Instruction ID: afd6f86e1ed7dc578beff9a6215ab27dc393fb41cabbec3b70aacfa27007612f
Opcode Fuzzy Hash: d8ebd7708255391ffa87ed53dd5dbf97c7cff7b52fcdad9dabb06971c835301f
Instruction Fuzzy Hash: EB014B72A196204B8308CE3C9C1112ABEE19B86330F158B2EBCFAD73E0D664CD548696

Function 0056B410 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 809ee23363f840c811a801533be2b64f834fb93f4c5a4ab9cc37b5a2fd812bb4
Instruction ID: abd206f3f1275cad55b4f3e66b6ef6ba06d0a55e4e84ff294d663f47e8708f48
Opcode Fuzzy Hash: 809ee23363f840c811a801533be2b64f834fb93f4c5a4ab9cc37b5a2fd812bb4
Instruction Fuzzy Hash: 05F0ECB260451057EF22CA55DCC4F37BF9DDB87365F190426E845D7103D6A15885C3E5

Function 00588220 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3c2236e634fcdb7aebdad6e0b4865d42b890e9a94bdfa7e54f5a7ae4a194d0f
Instruction ID: 4ed257820da1c0425ebce4b7ecb4c04e52443bedf2843561c661a4b06834eb84
Opcode Fuzzy Hash: a3c2236e634fcdb7aebdad6e0b4865d42b890e9a94bdfa7e54f5a7ae4a194d0f
Instruction Fuzzy Hash: 5101E4B04147009FC360EF29C545747BFF8FB08714F404A1DE8AECB680D770A5488B82

Function 00591440 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction ID: 8a2860eed419ce9de165675d571c6042937a2b1369d4225a5832e7ef1ecd9e8c
Opcode Fuzzy Hash: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction Fuzzy Hash: 0DD0A731608732469F748E19A400977FBF0FACBB51F49955EF58AE3148D230DC41C2AD

Function 00561ACD Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d341563eb4f07830b1a869b46323c6fb2348fac6fb40ac1c006d17c497977eb8
Instruction ID: ae77403c9a7b255400fe059583330c73aed04fc91847991d48b2c4bd801603f5
Opcode Fuzzy Hash: d341563eb4f07830b1a869b46323c6fb2348fac6fb40ac1c006d17c497977eb8
Instruction Fuzzy Hash: 29C08C34A580008FCA04CF90FC95432BBF8A3AB308710703BDA07F3321DBA0C40AAB09

Function 00596094 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55a30322a33983674d316c5ab5932ff0d1634174ccfcc7e204104b87b8607cd1
Instruction ID: 3c7bab1d33bf18f7c2f15320e489fc8be4d244dff3baea383fbca10be8a4d542
Opcode Fuzzy Hash: 55a30322a33983674d316c5ab5932ff0d1634174ccfcc7e204104b87b8607cd1
Instruction Fuzzy Hash: 1EC09B3465C00487D70CCF04D951475F7779BA771C724B01DD90723255D134D516A52C

Function 00561A3C Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cb15a249a6681f73b80845dd4aacb18e22380d353d139f11fcc1d16cb5f16d1
Instruction ID: 02cb33db12ae8ca48798457e0708e0de68a7b04f82b5372504544b7c27fb936b
Opcode Fuzzy Hash: 0cb15a249a6681f73b80845dd4aacb18e22380d353d139f11fcc1d16cb5f16d1
Instruction Fuzzy Hash: B4C04C24A990408A86448E85A991431A6E89316208715343B9606E7261D560D4099749

Function 00595FD6 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706016456.0000000000551000.00000040.00000001.01000000.00000003.sdmp, Offset: 00550000, based on PE: true

Associated: 00000000.00000002.1706000584.0000000000550000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706076323.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706100241.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706147304.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706165591.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706297117.0000000000716000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706325321.0000000000718000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706343418.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706372870.000000000073B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706383917.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706394945.0000000000746000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706409568.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706429444.0000000000762000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706464774.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706481028.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706518694.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706535658.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706548305.000000000078B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706571242.0000000000792000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706585867.0000000000794000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706600323.0000000000795000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706641995.0000000000798000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706658679.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706676367.00000000007A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706689237.00000000007AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706702133.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706714808.00000000007BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706726945.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706741721.00000000007C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706752739.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706767286.00000000007E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.00000000007E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706779985.0000000000809000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706813924.0000000000836000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706827409.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.0000000000838000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706839585.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706865854.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706878053.000000000084D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89a4287b66ad24384bd7d7240d6ba484cd68c007bb658305a3116f7f800ff57f
Instruction ID: 5b9ed57a66addfb5a5095210cdc84993483ee05233b230df6a36b8d3788f49b4
Opcode Fuzzy Hash: 89a4287b66ad24384bd7d7240d6ba484cd68c007bb658305a3116f7f800ff57f
Instruction Fuzzy Hash: 11C09224B680088BA34CCF18DD52975F2BB9BABA1CB14B02DD906A3256D134D51A962C

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

Windows Analysis Report
file.exe

Function 0055FCA0 Relevance: 6.6, Strings: 5, Instructions: 373
COMMON

Function 0058F620 Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 461
COMMON

Function 0055D110 Relevance: 1.7, APIs: 1, Instructions: 168
COMMON

Function 00595700 Relevance: 1.6, APIs: 1, Instructions: 69
memoryCOMMON

Function 00595BB0 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Function 00562F94 Relevance: 15.9, APIs: 1, Strings: 9, Instructions: 862
COMMON

Function 00593220 Relevance: 1.6, APIs: 1, Instructions: 59
memoryCOMMON

Function 0058F54B Relevance: 1.6, APIs: 1, Instructions: 52
memoryCOMMON

Function 0058F5FC Relevance: 1.5, APIs: 1, Instructions: 13
COMMON

Function 00562F6F Relevance: 1.5, APIs: 1, Instructions: 13
COMMON