Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1540503
MD5:	81a343f401c4d91848fcd321415da84d
SHA1:	5dddc1821c371c7c2eb98dc8d80379f93088b3b8
SHA256:	1cbd31dee64216130c84c78a046e0f0733618459f7288f7e024431167bb7ad75
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

PE file contains section with special chars

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Detected potential crypto function

Entry point lies outside standard sections

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 6944 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 81A343F401C4D91848FCD321415DA84D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["bathdoomgaz.store", "licendfilteo.site", "clearancek.site", "dissapoiznw.store", "eaglepawnoy.store", "studennotediw.store", "spirittunek.store", "mobbipenju.store"], "Build id": "4SD0y4--legendaryy"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-23T20:54:01.735767+0200	2056477	1	Domain Observed Used for C2 Detected	192.168.2.4	53449	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-23T20:54:01.664691+0200	2056471	1	Domain Observed Used for C2 Detected	192.168.2.4	56995	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-23T20:54:01.704103+0200	2056481	1	Domain Observed Used for C2 Detected	192.168.2.4	50259	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-23T20:54:01.691573+0200	2056483	1	Domain Observed Used for C2 Detected	192.168.2.4	51157	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-23T20:54:01.767236+0200	2056473	1	Domain Observed Used for C2 Detected	192.168.2.4	51770	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-23T20:54:01.677229+0200	2056485	1	Domain Observed Used for C2 Detected	192.168.2.4	56422	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-23T20:54:01.751402+0200	2056475	1	Domain Observed Used for C2 Detected	192.168.2.4	61328	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-23T20:54:01.720070+0200	2056479	1	Domain Observed Used for C2 Detected	192.168.2.4	62493	1.1.1.1	53	UDP

ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-23T20:54:03.801135+0200	2858666	1	Domain Observed Used for C2 Detected	192.168.2.4	49730	104.102.49.254	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://steamcommunity.com:443/profiles/76561199724331900

URL Reputation: Label: malware

Found malware configuration

Source: file.exe.6944.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["bathdoomgaz.store", "licendfilteo.site", "clearancek.site", "dissapoiznw.store", "eaglepawnoy.store", "studennotediw.store", "spirittunek.store", "mobbipenju.store"], "Build id": "4SD0y4--legendaryy"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp	String decryptor: clearancek.site
Source: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp	String decryptor: licendfilteo.site
Source: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp	String decryptor: spirittunek.store
Source: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp	String decryptor: bathdoomgaz.store
Source: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp	String decryptor: studennotediw.store
Source: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp	String decryptor: dissapoiznw.store
Source: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp	String decryptor: eaglepawnoy.store
Source: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp	String decryptor: mobbipenju.store
Source: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp	String decryptor: clearancek.site
Source: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp	String decryptor: 4SD0y4--legendaryy

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:49730 version: TLS 1.2

Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_0038D110
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_0038D110
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	0_2_003C63B8
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_003C5700
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 27BAF212h	0_2_003C695B
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	0_2_003C99D0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	0_2_0038FCA0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	0_2_00390EEC
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then dec ebx	0_2_003BF030
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+20h]	0_2_00396F91
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ecx, dword ptr [edx]	0_2_00381000
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	0_2_003C4040
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp ecx	0_2_003C6094
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	0_2_003AD1E1
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_003A2260
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [esi], ax	0_2_003A2260
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	0_2_003942FC
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ebp, eax	0_2_0038A300
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_003B23E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_003B23E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_003B23E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_003B23E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_003B23E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+14h]	0_2_003B23E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov dword ptr [esp], 00000000h	0_2_0039B410
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	0_2_003AE40C
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	0_2_003AC470
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_0039D457
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx eax, word ptr [esi+ecx]	0_2_003C1440
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	0_2_003C64B8
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	0_2_00396536
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 7789B0CBh	0_2_003C7520
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_003A9510
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	0_2_003AE66A
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	0_2_003BB650
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ecx, word ptr [edi+eax]	0_2_003C7710
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	0_2_003AD7AF
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	0_2_003C67EF
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_003A28E9
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 62429966h	0_2_003C3920
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	0_2_0039D961
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	0_2_003849A0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	0_2_00391A3C
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ebx]	0_2_00385A50
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	0_2_003C4A40
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	0_2_00391ACD
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+000006B8h]	0_2_0039DB6F
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F8FD61B8h	0_2_0039DB6F
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	0_2_003C9B60
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	0_2_003B0B80
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	0_2_00391BEE
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	0_2_00393BE2
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], A70A987Fh	0_2_003BFC20
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	0_2_003A7C00
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp word ptr [eax+esi+02h], 0000h	0_2_003AEC48
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	0_2_003AAC91
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [edx], ax	0_2_003AAC91
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_003C9CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebp+edx*8+00h], 9ECF05EBh	0_2_003C9CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], C85F7986h	0_2_003ACCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_003ACCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C85F7986h	0_2_003ACCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	0_2_003ADD29
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov dword ptr [esp+1Ch], 5E46585Eh	0_2_003AFD10
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_003C8D8A
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov edi, ecx	0_2_00394E2A
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_003A5E70
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_003A7E60
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ebx, word ptr [ecx]	0_2_003AAE57
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp byte ptr [ebx], 00000000h	0_2_00396EBF
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ecx, word ptr [ebp+00h]	0_2_0038BEB0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edi, byte ptr [ecx+esi]	0_2_00386EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	0_2_00391E93
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_003BFF70
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	0_2_003A9F62
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+20h]	0_2_00396F91
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [edx], 0000h	0_2_0039FFDF
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp ecx	0_2_00388FD0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp ecx	0_2_003C5FD6
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], F3285E74h	0_2_003C7FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_003C7FC0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2056483 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store) : 192.168.2.4:51157 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056477 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store) : 192.168.2.4:53449 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056479 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store) : 192.168.2.4:62493 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056485 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store) : 192.168.2.4:56422 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056475 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store) : 192.168.2.4:61328 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056471 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site) : 192.168.2.4:56995 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056481 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store) : 192.168.2.4:50259 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056473 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site) : 192.168.2.4:51770 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.4:49730 -> 104.102.49.254:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: bathdoomgaz.store
Source: Malware configuration extractor	URLs: licendfilteo.site
Source: Malware configuration extractor	URLs: clearancek.site
Source: Malware configuration extractor	URLs: dissapoiznw.store
Source: Malware configuration extractor	URLs: eaglepawnoy.store
Source: Malware configuration extractor	URLs: studennotediw.store
Source: Malware configuration extractor	URLs: spirittunek.store
Source: Malware configuration extractor	URLs: mobbipenju.store

Source: Joe Sandbox View

IP Address: 104.102.49.254 104.102.49.254

Source: Joe Sandbox View

ASN Name: AKAMAI-ASUS AKAMAI-ASUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic

HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

Source: file.exe, 00000000.00000002.1744384288.00000000012FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Cb9e7f3651c38ac41ccf738a8ba3498dc; Path=/; Secure; HttpOnly; SameSite=Nonesessionid=1d20356a57eb04100980c006; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type26105Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveWed, 23 Oct 2024 18:54:03 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-Control equals www.youtube.com (Youtube)
Source: file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: clearancek.site
Source: global traffic	DNS traffic detected: DNS query: mobbipenju.store
Source: global traffic	DNS traffic detected: DNS query: eaglepawnoy.store
Source: global traffic	DNS traffic detected: DNS query: dissapoiznw.store
Source: global traffic	DNS traffic detected: DNS query: studennotediw.store
Source: global traffic	DNS traffic detected: DNS query: bathdoomgaz.store
Source: global traffic	DNS traffic detected: DNS query: spirittunek.store
Source: global traffic	DNS traffic detected: DNS query: licendfilteo.site
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com

Source: file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1744384288.00000000012FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: file.exe, 00000000.00000002.1744214208.00000000012D0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739700886.00000000012D0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: file.exe, 00000000.00000002.1744214208.00000000012D0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739700886.00000000012D0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: file.exe, 00000000.00000002.1744214208.00000000012D0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739700886.00000000012D0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: file.exe, 00000000.00000002.1744384288.00000000012FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1744384288.00000000012FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1744384288.00000000012FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/
Source: file.exe, 00000000.00000002.1744384288.00000000012FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: file.exe, 00000000.00000002.1744214208.00000000012AF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739700886.00000000012AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clearancek.site:443/apiW
Source: file.exe, 00000000.00000002.1744214208.00000000012AF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739700886.00000000012AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clearancek.site:443/apiin
Source: file.exe, 00000000.00000002.1744384288.00000000012FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/
Source: file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/applications/community/main.css?v=ljhW-PbGuX
Source: file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/globalv2.css?v=pwVcIAtHNXwg&l=english&am
Source: file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/fatalerror.css?v=wctRWaBvNt2z&l=e
Source: file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/header.css?v=vh4BMeDcNiCU&l=engli
Source: file.exe, 00000000.00000002.1744214208.00000000012D0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739700886.00000000012D0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: file.exe, 00000000.00000002.1744214208.00000000012D0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739700886.00000000012D0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/libraries~b28b
Source: file.exe, 00000000.00000002.1744214208.00000000012D0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739700886.00000000012D0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/main.js?v=W9BX
Source: file.exe, 00000000.00000002.1744214208.00000000012D0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739700886.00000000012D0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/manifest.js?v=
Source: file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/global.js?v=bOP7RorZq4_W&l=englis
Source: file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC&
Source: file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw&
Source: file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpE
Source: file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/buttons.css?v=tuNiaSwXwcYT&l=engl
Source: file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/motiva_sans.css?v=GfSjbGKcNYaQ&l=
Source: file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/shared_global.css?v=Ff_1prscqzeu&
Source: file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/shared_responsive.css?v=eghn9DNyCY67&
Source: file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.p
Source: file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1
Source: file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_global.js?v=wJD9maDpDcV
Source: file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v
Source: file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0&amp
Source: file.exe, 00000000.00000002.1744384288.00000000012FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: file.exe, 00000000.00000002.1744384288.00000000012FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1744384288.00000000012FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1744384288.00000000012FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: file.exe, 00000000.00000002.1744214208.00000000012AF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739700886.00000000012AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mobbipenju.store:443/apiv
Source: file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1744384288.00000000012FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1744384288.00000000012FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1744384288.00000000012FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1744384288.00000000012FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1744384288.00000000012FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: file.exe, 00000000.00000002.1744214208.00000000012AF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739700886.00000000012AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://spirittunek.store:443/api
Source: file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1744384288.00000000012FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1744384288.00000000012FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1744384288.00000000012FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1744384288.00000000012FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: file.exe, 00000000.00000002.1744214208.00000000012D0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739700886.00000000012D0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com
Source: file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/7
Source: file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: file.exe, 00000000.00000002.1744214208.00000000012D0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739700886.00000000012D0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: file.exe, 00000000.00000003.1739700886.00000000012AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: file.exe, 00000000.00000002.1744214208.00000000012AF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739700886.00000000012AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com:443/profiles/76561199724331900
Source: file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: file.exe, 00000000.00000003.1739774093.00000000012FB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1744384288.00000000012FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Cb9e7f3651c38ac4
Source: file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: file.exe, 00000000.00000002.1744214208.00000000012D0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739700886.00000000012D0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: file.exe, 00000000.00000002.1744214208.00000000012AF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739700886.00000000012AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://studennotediw.store:443/api
Source: file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1744384288.00000000012FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: file.exe, 00000000.00000002.1744384288.00000000012FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1744384288.00000000012FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1744384288.00000000012FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: file.exe, 00000000.00000003.1739594724.00000000012DF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1744384288.00000000012FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1744384288.00000000012FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443

Source: unknown

HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:49730 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00390228	0_2_00390228
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00392030	0_2_00392030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00381000	0_2_00381000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003C4040	0_2_003C4040
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004B40A9	0_2_004B40A9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003CA0D0	0_2_003CA0D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0068D17C	0_2_0068D17C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00385160	0_2_00385160
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0038E1A0	0_2_0038E1A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003871F0	0_2_003871F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00553244	0_2_00553244
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0043B25F	0_2_0043B25F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003812F7	0_2_003812F7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003B82D0	0_2_003B82D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003B12D0	0_2_003B12D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0038A300	0_2_0038A300
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005583DC	0_2_005583DC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0038B3A0	0_2_0038B3A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003813A3	0_2_003813A3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004E43FD	0_2_004E43FD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003B23E0	0_2_003B23E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003AC470	0_2_003AC470
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0039049B	0_2_0039049B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00394487	0_2_00394487
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003B64F0	0_2_003B64F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003835B0	0_2_003835B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0039C5F0	0_2_0039C5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003BF620	0_2_003BF620
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003C8652	0_2_003C8652
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0038164F	0_2_0038164F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0054C6CF	0_2_0054C6CF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003C86F0	0_2_003C86F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003B1860	0_2_003B1860
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005568D1	0_2_005568D1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003BE8A0	0_2_003BE8A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003BB8C0	0_2_003BB8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003C89A0	0_2_003C89A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003A098B	0_2_003A098B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003C4A40	0_2_003C4A40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003C7AB0	0_2_003C7AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003C8A80	0_2_003C8A80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0039DB6F	0_2_0039DB6F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00387BF0	0_2_00387BF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003C8C02	0_2_003C8C02
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003C6CBF	0_2_003C6CBF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003ACCD0	0_2_003ACCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003ADD29	0_2_003ADD29
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00554D40	0_2_00554D40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00559D48	0_2_00559D48
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003AFD10	0_2_003AFD10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003A8D62	0_2_003A8D62
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00408DCA	0_2_00408DCA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00394E2A	0_2_00394E2A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003C8E70	0_2_003C8E70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003AAE57	0_2_003AAE57
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00396EBF	0_2_00396EBF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0038BEB0	0_2_0038BEB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0038AF10	0_2_0038AF10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00388FD0	0_2_00388FD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003C7FC0	0_2_003C7FC0

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 0038CAA0 appears 48 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 0039D300 appears 152 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: ZLIB complexity 0.9993425123762376

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@9/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_003B8220 CoCreateInstance,

0_2_003B8220

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: file.exe	String found in binary or memory: ]RtlAllocateHeap3Cannot find '%s'. Please, re-install this applicationThunRTMain__vbaVarTstNeV

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior

Source: file.exe

Static file information: File size 2974208 > 1048576

Source: file.exe

Static PE information: Raw size of mcrbadlk is bigger than: 0x100000 < 0x2acc00

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.380000.0.unpack :EW;.rsrc :W;.idata :W;mcrbadlk:EW;rfimzgrw:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W;mcrbadlk:EW;rfimzgrw:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x2df0ae should be: 0x2dce81

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name: mcrbadlk
Source: file.exe	Static PE information: section name: rfimzgrw
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00582070 push eax; mov dword ptr [esp], 6D75CB9Bh	0_2_0058208D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00582070 push 4EE230A6h; mov dword ptr [esp], eax	0_2_005820F9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0068D051 push 28BF73B0h; mov dword ptr [esp], ecx	0_2_0068D08B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0068D051 push ebp; mov dword ptr [esp], ecx	0_2_0068D0AE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0068D051 push 661AFC74h; mov dword ptr [esp], eax	0_2_0068D0C1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0068D051 push esi; mov dword ptr [esp], 67F28900h	0_2_0068D0D6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0068D051 push 78CF2413h; mov dword ptr [esp], ecx	0_2_0068D108
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0068D051 push 09F1CCC4h; mov dword ptr [esp], edx	0_2_0068D11A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0068D051 push edi; mov dword ptr [esp], eax	0_2_0068D124
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0068D051 push ecx; mov dword ptr [esp], edx	0_2_0068D169
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0068D035 push 28BF73B0h; mov dword ptr [esp], ecx	0_2_0068D08B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0068D035 push ebp; mov dword ptr [esp], ecx	0_2_0068D0AE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0068D035 push 661AFC74h; mov dword ptr [esp], eax	0_2_0068D0C1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0068D035 push esi; mov dword ptr [esp], 67F28900h	0_2_0068D0D6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0068D035 push 78CF2413h; mov dword ptr [esp], ecx	0_2_0068D108
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0068D035 push 09F1CCC4h; mov dword ptr [esp], edx	0_2_0068D11A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0068D035 push edi; mov dword ptr [esp], eax	0_2_0068D124
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0068D035 push ecx; mov dword ptr [esp], edx	0_2_0068D169
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045C03D push 110BDCC4h; mov dword ptr [esp], ebp	0_2_0045C0B6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045C03D push 01DF4F62h; mov dword ptr [esp], edi	0_2_0045C0C6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045C03D push eax; mov dword ptr [esp], 79FDC052h	0_2_0045C13A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045C03D push ebp; mov dword ptr [esp], ecx	0_2_0045C161
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045C03D push 31719111h; mov dword ptr [esp], edi	0_2_0045C190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045C03D push ebp; mov dword ptr [esp], 3BBE3CA1h	0_2_0045C240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0058D023 push 1B2E4643h; mov dword ptr [esp], ebx	0_2_0058D03D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0058D023 push ecx; mov dword ptr [esp], 11B6B0D1h	0_2_0058D056
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003E50FD push edi; mov dword ptr [esp], edx	0_2_003E5757
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004B40A9 push 39C2191Bh; mov dword ptr [esp], edx	0_2_004B4113
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004B40A9 push 6CB88D8Eh; mov dword ptr [esp], edi	0_2_004B4159
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004B40A9 push eax; mov dword ptr [esp], esi	0_2_004B418B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004B40A9 push edx; mov dword ptr [esp], 5FFE5C5Eh	0_2_004B418F

Source: file.exe

Static PE information: section name: entropy: 7.976192682340559

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E4491 second address: 3E4495 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E4495 second address: 3E3D2B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007FA198D78885h 0x0000000d nop 0x0000000e jmp 00007FA198D7887Ah 0x00000013 stc 0x00000014 push dword ptr [ebp+122D00E1h] 0x0000001a pushad 0x0000001b jp 00007FA198D7887Ch 0x00000021 sub dl, FFFFFFD6h 0x00000024 popad 0x00000025 call dword ptr [ebp+122D281Bh] 0x0000002b pushad 0x0000002c mov dword ptr [ebp+122D1DBFh], edi 0x00000032 xor eax, eax 0x00000034 stc 0x00000035 mov edx, dword ptr [esp+28h] 0x00000039 jo 00007FA198D7887Eh 0x0000003f jns 00007FA198D78878h 0x00000045 mov dword ptr [ebp+122D3949h], eax 0x0000004b mov dword ptr [ebp+122D1DBFh], esi 0x00000051 mov esi, 0000003Ch 0x00000056 jc 00007FA198D7887Ch 0x0000005c add esi, dword ptr [esp+24h] 0x00000060 cmc 0x00000061 lodsw 0x00000063 jmp 00007FA198D78885h 0x00000068 add eax, dword ptr [esp+24h] 0x0000006c stc 0x0000006d mov ebx, dword ptr [esp+24h] 0x00000071 mov dword ptr [ebp+122D1DBFh], esi 0x00000077 push eax 0x00000078 pushad 0x00000079 jne 00007FA198D7887Ch 0x0000007f pushad 0x00000080 push eax 0x00000081 push edx 0x00000082 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E3D2B second address: 3E3D31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F7AC second address: 54F7B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F7B4 second address: 54F7BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F7BD second address: 54F7C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F7C3 second address: 54F7C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55E9EF second address: 55E9F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55E9F3 second address: 55E9F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55EB64 second address: 55EB6C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55EB6C second address: 55EB73 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55F10C second address: 55F117 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55F117 second address: 55F11B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 561844 second address: 561848 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56198D second address: 561A38 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FA198D66586h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c jp 00007FA198D66596h 0x00000012 nop 0x00000013 push 00000000h 0x00000015 push ebx 0x00000016 call 00007FA198D66588h 0x0000001b pop ebx 0x0000001c mov dword ptr [esp+04h], ebx 0x00000020 add dword ptr [esp+04h], 0000001Ch 0x00000028 inc ebx 0x00000029 push ebx 0x0000002a ret 0x0000002b pop ebx 0x0000002c ret 0x0000002d push esi 0x0000002e and esi, dword ptr [ebp+122D3AB9h] 0x00000034 pop edi 0x00000035 push 00000000h 0x00000037 call 00007FA198D6658Bh 0x0000003c mov ecx, dword ptr [ebp+122D3AF1h] 0x00000042 pop edx 0x00000043 push 36520DE4h 0x00000048 jmp 00007FA198D66593h 0x0000004d xor dword ptr [esp], 36520D64h 0x00000054 mov dword ptr [ebp+122D209Fh], eax 0x0000005a push 00000003h 0x0000005c xor dword ptr [ebp+122D1E16h], edi 0x00000062 push 00000000h 0x00000064 mov dx, cx 0x00000067 push 00000003h 0x00000069 push 9D9078CDh 0x0000006e pushad 0x0000006f pushad 0x00000070 pushad 0x00000071 popad 0x00000072 jbe 00007FA198D66586h 0x00000078 popad 0x00000079 push eax 0x0000007a push edx 0x0000007b push esi 0x0000007c pop esi 0x0000007d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 561A38 second address: 561A3C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 561A3C second address: 561A79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xor dword ptr [esp], 5D9078CDh 0x0000000e jmp 00007FA198D66595h 0x00000013 lea ebx, dword ptr [ebp+1245172Dh] 0x00000019 mov dword ptr [ebp+122D2CD9h], eax 0x0000001f push eax 0x00000020 pushad 0x00000021 js 00007FA198D66588h 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 561A79 second address: 561A7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 561AD3 second address: 561AD7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 561AD7 second address: 561ADD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 561ADD second address: 561AE3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 572EFB second address: 572F0C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA198D7887Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 572F0C second address: 572F12 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54A73F second address: 54A743 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54A743 second address: 54A747 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54A747 second address: 54A753 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 580D43 second address: 580D57 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FA198D6658Ch 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 580D57 second address: 580D5D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 580D5D second address: 580D61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 580D61 second address: 580D65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 580D65 second address: 580D79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a pop eax 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 580D79 second address: 580D87 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FA198D78876h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 580D87 second address: 580D8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 580D8B second address: 580DAB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA198D78882h 0x00000007 jmp 00007FA198D7887Ah 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 580F0F second address: 580F15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 580F15 second address: 580F36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 jmp 00007FA198D78887h 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 580F36 second address: 580F7F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA198D6658Fh 0x00000007 push esi 0x00000008 jmp 00007FA198D6658Ch 0x0000000d jmp 00007FA198D66597h 0x00000012 pop esi 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push edx 0x00000016 jns 00007FA198D66588h 0x0000001c push eax 0x0000001d push edx 0x0000001e jp 00007FA198D66586h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 580F7F second address: 580F83 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 581100 second address: 581104 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 581379 second address: 581389 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA198D7887Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 581389 second address: 58138F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58138F second address: 58139D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA198D7887Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 581633 second address: 581637 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 581B90 second address: 581B9A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007FA198D78876h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 581B9A second address: 581B9E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 581E9B second address: 581E9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 581E9F second address: 581ED7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jg 00007FA198D66592h 0x0000000c jnc 00007FA198D66586h 0x00000012 jl 00007FA198D66586h 0x00000018 popad 0x00000019 push ecx 0x0000001a jmp 00007FA198D6658Eh 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007FA198D6658Eh 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5825D9 second address: 5825E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5825E1 second address: 5825E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 582743 second address: 582747 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 582747 second address: 582759 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007FA198D6658Ah 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 582759 second address: 582780 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FA198D7887Eh 0x00000008 pushad 0x00000009 js 00007FA198D78876h 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 jl 00007FA198D7888Eh 0x0000001c push ecx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 582901 second address: 582918 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA198D66593h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 582918 second address: 58291E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 582A65 second address: 582A69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 582A69 second address: 582A6D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 582A6D second address: 582A9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FA198D6658Bh 0x0000000c push edi 0x0000000d pop edi 0x0000000e jmp 00007FA198D66592h 0x00000013 popad 0x00000014 pop ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 push edi 0x00000018 jc 00007FA198D66586h 0x0000001e pop edi 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 582D6F second address: 582D94 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jc 00007FA198D78876h 0x0000000d jmp 00007FA198D7887Dh 0x00000012 jc 00007FA198D78876h 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b push edi 0x0000001c pop edi 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 582D94 second address: 582DA4 instructions: 0x00000000 rdtsc 0x00000002 je 00007FA198D66586h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 582DA4 second address: 582DB4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a jnp 00007FA198D78876h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58553A second address: 58554F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FA198D66586h 0x0000000a pop ebx 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f push edx 0x00000010 pop edx 0x00000011 pop ecx 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58554F second address: 585581 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA198D78887h 0x00000009 jmp 00007FA198D78880h 0x0000000e jnp 00007FA198D78876h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C20D second address: 54C213 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 586CA6 second address: 586CBE instructions: 0x00000000 rdtsc 0x00000002 jo 00007FA198D78876h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jno 00007FA198D7887Eh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5881E8 second address: 5881EE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5881EE second address: 588214 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA198D78888h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d jp 00007FA198D78876h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 590016 second address: 59001B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59001B second address: 590020 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 590020 second address: 590026 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58F48B second address: 58F4DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA198D78881h 0x00000009 pop ebx 0x0000000a jnc 00007FA198D7888Fh 0x00000010 jmp 00007FA198D78888h 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58F4DC second address: 58F4E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FA198D66586h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58F7B4 second address: 58F7C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58F7C1 second address: 58F7D1 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FA198D66586h 0x00000008 jne 00007FA198D66586h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58F7D1 second address: 58F7D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58F7D7 second address: 58F7DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58F7DD second address: 58F7E7 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FA198D78876h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58F7E7 second address: 58F7F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FA198D6658Ah 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58F7F9 second address: 58F811 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA198D78884h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59313E second address: 593148 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007FA198D66586h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 593148 second address: 59315F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jg 00007FA198D7887Ch 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59322B second address: 593287 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA198D66595h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 6CC37E98h 0x00000010 push 00000000h 0x00000012 push edi 0x00000013 call 00007FA198D66588h 0x00000018 pop edi 0x00000019 mov dword ptr [esp+04h], edi 0x0000001d add dword ptr [esp+04h], 00000018h 0x00000025 inc edi 0x00000026 push edi 0x00000027 ret 0x00000028 pop edi 0x00000029 ret 0x0000002a cmc 0x0000002b mov dword ptr [ebp+122D2734h], ebx 0x00000031 push 3BED47E6h 0x00000036 push eax 0x00000037 push edx 0x00000038 pushad 0x00000039 jng 00007FA198D66586h 0x0000003f js 00007FA198D66586h 0x00000045 popad 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 593287 second address: 59329D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA198D78882h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59358A second address: 59358E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59358E second address: 593594 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 593594 second address: 593599 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 593FDC second address: 593FE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59496B second address: 59496F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59496F second address: 594973 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 598A31 second address: 598A39 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5977B8 second address: 5977C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007FA198D78876h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 598A39 second address: 598A3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 598A3D second address: 598A59 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FA198D78881h 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55982F second address: 559849 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA198D66594h 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59914A second address: 599167 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FA198D78886h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 599167 second address: 59916B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5999A3 second address: 5999B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jo 00007FA198D78878h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59A881 second address: 59A88B instructions: 0x00000000 rdtsc 0x00000002 jp 00007FA198D66586h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A029F second address: 5A0311 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 mov dword ptr [esp], eax 0x00000008 call 00007FA198D7887Ch 0x0000000d mov edi, 1CEECF20h 0x00000012 pop edi 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push esi 0x00000018 call 00007FA198D78878h 0x0000001d pop esi 0x0000001e mov dword ptr [esp+04h], esi 0x00000022 add dword ptr [esp+04h], 00000016h 0x0000002a inc esi 0x0000002b push esi 0x0000002c ret 0x0000002d pop esi 0x0000002e ret 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push edi 0x00000034 call 00007FA198D78878h 0x00000039 pop edi 0x0000003a mov dword ptr [esp+04h], edi 0x0000003e add dword ptr [esp+04h], 00000015h 0x00000046 inc edi 0x00000047 push edi 0x00000048 ret 0x00000049 pop edi 0x0000004a ret 0x0000004b pushad 0x0000004c mov edi, dword ptr [ebp+122D3B81h] 0x00000052 jmp 00007FA198D7887Ah 0x00000057 popad 0x00000058 push eax 0x00000059 push eax 0x0000005a pushad 0x0000005b push edx 0x0000005c pop edx 0x0000005d push eax 0x0000005e push edx 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59E486 second address: 59E498 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FA198D66586h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jc 00007FA198D66586h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59F501 second address: 59F505 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A15A8 second address: 5A15AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59E498 second address: 59E540 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA198D78886h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a nop 0x0000000b mov bx, di 0x0000000e push dword ptr fs:[00000000h] 0x00000015 push 00000000h 0x00000017 push eax 0x00000018 call 00007FA198D78878h 0x0000001d pop eax 0x0000001e mov dword ptr [esp+04h], eax 0x00000022 add dword ptr [esp+04h], 00000016h 0x0000002a inc eax 0x0000002b push eax 0x0000002c ret 0x0000002d pop eax 0x0000002e ret 0x0000002f mov bh, 83h 0x00000031 mov dword ptr fs:[00000000h], esp 0x00000038 mov dword ptr [ebp+122D2B84h], ecx 0x0000003e mov eax, dword ptr [ebp+122D1689h] 0x00000044 mov dword ptr [ebp+12476A95h], edx 0x0000004a push FFFFFFFFh 0x0000004c call 00007FA198D78888h 0x00000051 mov ebx, dword ptr [ebp+122D3939h] 0x00000057 pop edi 0x00000058 xor edi, dword ptr [ebp+122D3B75h] 0x0000005e nop 0x0000005f push ebx 0x00000060 jmp 00007FA198D78888h 0x00000065 pop ebx 0x00000066 push eax 0x00000067 push eax 0x00000068 push edx 0x00000069 push eax 0x0000006a push edx 0x0000006b push eax 0x0000006c push edx 0x0000006d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A26BC second address: 5A26D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 jnl 00007FA198D66586h 0x0000000c jnl 00007FA198D66586h 0x00000012 popad 0x00000013 popad 0x00000014 push eax 0x00000015 pushad 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A3599 second address: 5A359D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A15AC second address: 5A15B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59E540 second address: 59E544 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A26D5 second address: 5A26EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA198D6658Eh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A359D second address: 5A35A3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A15B6 second address: 5A15BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59E544 second address: 59E54A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A26EC second address: 5A26F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A35A3 second address: 5A35DC instructions: 0x00000000 rdtsc 0x00000002 jc 00007FA198D78878h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f jmp 00007FA198D78881h 0x00000014 push 00000000h 0x00000016 add dword ptr [ebp+122D2749h], ecx 0x0000001c push 00000000h 0x0000001e mov edi, dword ptr [ebp+122D3911h] 0x00000024 xchg eax, esi 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 push ebx 0x00000029 pop ebx 0x0000002a pushad 0x0000002b popad 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A15BA second address: 5A15BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A35DC second address: 5A35E3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A15BE second address: 5A15CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A2797 second address: 5A279D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A35E3 second address: 5A3605 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jmp 00007FA198D66594h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A279D second address: 5A27A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A15CC second address: 5A1677 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FA198D66588h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push edi 0x00000010 call 00007FA198D66588h 0x00000015 pop edi 0x00000016 mov dword ptr [esp+04h], edi 0x0000001a add dword ptr [esp+04h], 00000014h 0x00000022 inc edi 0x00000023 push edi 0x00000024 ret 0x00000025 pop edi 0x00000026 ret 0x00000027 mov di, 07B0h 0x0000002b push dword ptr fs:[00000000h] 0x00000032 mov dword ptr [ebp+122D1D89h], ebx 0x00000038 mov dword ptr fs:[00000000h], esp 0x0000003f sbb bh, FFFFFFAEh 0x00000042 mov eax, dword ptr [ebp+122D0505h] 0x00000048 mov bx, A238h 0x0000004c mov dword ptr [ebp+122D3397h], ebx 0x00000052 push FFFFFFFFh 0x00000054 push 00000000h 0x00000056 push eax 0x00000057 call 00007FA198D66588h 0x0000005c pop eax 0x0000005d mov dword ptr [esp+04h], eax 0x00000061 add dword ptr [esp+04h], 00000017h 0x00000069 inc eax 0x0000006a push eax 0x0000006b ret 0x0000006c pop eax 0x0000006d ret 0x0000006e sub edi, dword ptr [ebp+122D3A71h] 0x00000074 nop 0x00000075 pushad 0x00000076 pushad 0x00000077 push esi 0x00000078 pop esi 0x00000079 jmp 00007FA198D66594h 0x0000007e popad 0x0000007f push eax 0x00000080 push edx 0x00000081 jmp 00007FA198D66594h 0x00000086 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A4556 second address: 5A455A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A7ADE second address: 5A7AE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A6CA5 second address: 5A6CA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A8993 second address: 5A8A0F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA198D66590h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jo 00007FA198D6658Ch 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 nop 0x00000017 push 00000000h 0x00000019 push ebx 0x0000001a call 00007FA198D66588h 0x0000001f pop ebx 0x00000020 mov dword ptr [esp+04h], ebx 0x00000024 add dword ptr [esp+04h], 00000017h 0x0000002c inc ebx 0x0000002d push ebx 0x0000002e ret 0x0000002f pop ebx 0x00000030 ret 0x00000031 push 00000000h 0x00000033 mov di, 3898h 0x00000037 push 00000000h 0x00000039 push 00000000h 0x0000003b push edx 0x0000003c call 00007FA198D66588h 0x00000041 pop edx 0x00000042 mov dword ptr [esp+04h], edx 0x00000046 add dword ptr [esp+04h], 00000018h 0x0000004e inc edx 0x0000004f push edx 0x00000050 ret 0x00000051 pop edx 0x00000052 ret 0x00000053 mov bx, 6060h 0x00000057 mov ebx, dword ptr [ebp+122D1CB6h] 0x0000005d mov edi, ebx 0x0000005f xchg eax, esi 0x00000060 push eax 0x00000061 push edx 0x00000062 push eax 0x00000063 push edx 0x00000064 push esi 0x00000065 pop esi 0x00000066 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A8A0F second address: 5A8A15 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A8A15 second address: 5A8A1A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AB07E second address: 5AB084 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AB084 second address: 5AB095 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FA198D66586h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push esi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AB2BA second address: 5AB2C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AEF22 second address: 5AEF82 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007FA198D66588h 0x0000000c popad 0x0000000d push eax 0x0000000e jbe 00007FA198D6658Ah 0x00000014 push eax 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 pop eax 0x00000018 nop 0x00000019 mov edi, dword ptr [ebp+122D3951h] 0x0000001f push 00000000h 0x00000021 mov dword ptr [ebp+122D1E16h], edi 0x00000027 push 00000000h 0x00000029 mov edi, dword ptr [ebp+122D287Fh] 0x0000002f jmp 00007FA198D6658Eh 0x00000034 xchg eax, esi 0x00000035 jmp 00007FA198D66595h 0x0000003a push eax 0x0000003b push eax 0x0000003c push edx 0x0000003d jp 00007FA198D66588h 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AE114 second address: 5AE1B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA198D7887Dh 0x00000009 popad 0x0000000a nop 0x0000000b mov ebx, edx 0x0000000d mov edi, dword ptr [ebp+122D2A1Dh] 0x00000013 push dword ptr fs:[00000000h] 0x0000001a push 00000000h 0x0000001c push edx 0x0000001d call 00007FA198D78878h 0x00000022 pop edx 0x00000023 mov dword ptr [esp+04h], edx 0x00000027 add dword ptr [esp+04h], 0000001Ch 0x0000002f inc edx 0x00000030 push edx 0x00000031 ret 0x00000032 pop edx 0x00000033 ret 0x00000034 add dword ptr [ebp+122D1F7Dh], ebx 0x0000003a mov dword ptr [ebp+12456525h], ebx 0x00000040 mov dword ptr fs:[00000000h], esp 0x00000047 push 00000000h 0x00000049 push edi 0x0000004a call 00007FA198D78878h 0x0000004f pop edi 0x00000050 mov dword ptr [esp+04h], edi 0x00000054 add dword ptr [esp+04h], 0000001Dh 0x0000005c inc edi 0x0000005d push edi 0x0000005e ret 0x0000005f pop edi 0x00000060 ret 0x00000061 jmp 00007FA198D7887Ch 0x00000066 mov eax, dword ptr [ebp+122D0A45h] 0x0000006c mov ebx, 2E415276h 0x00000071 push FFFFFFFFh 0x00000073 mov bx, 2975h 0x00000077 push eax 0x00000078 push eax 0x00000079 push edx 0x0000007a push eax 0x0000007b pushad 0x0000007c popad 0x0000007d pop eax 0x0000007e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AE1B6 second address: 5AE1BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B009D second address: 5B00A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B00A1 second address: 5B0131 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FA198D66590h 0x0000000b popad 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push ecx 0x00000012 call 00007FA198D66588h 0x00000017 pop ecx 0x00000018 mov dword ptr [esp+04h], ecx 0x0000001c add dword ptr [esp+04h], 0000001Ah 0x00000024 inc ecx 0x00000025 push ecx 0x00000026 ret 0x00000027 pop ecx 0x00000028 ret 0x00000029 push 00000000h 0x0000002b push 00000000h 0x0000002d push edi 0x0000002e call 00007FA198D66588h 0x00000033 pop edi 0x00000034 mov dword ptr [esp+04h], edi 0x00000038 add dword ptr [esp+04h], 00000016h 0x00000040 inc edi 0x00000041 push edi 0x00000042 ret 0x00000043 pop edi 0x00000044 ret 0x00000045 jmp 00007FA198D66594h 0x0000004a push 00000000h 0x0000004c mov dword ptr [ebp+122D20D4h], edi 0x00000052 xchg eax, esi 0x00000053 pushad 0x00000054 push ecx 0x00000055 jmp 00007FA198D6658Fh 0x0000005a pop ecx 0x0000005b pushad 0x0000005c pushad 0x0000005d popad 0x0000005e push eax 0x0000005f push edx 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B02CB second address: 5B02D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007FA198D78876h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B8810 second address: 5B881B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B881B second address: 5B8823 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BD244 second address: 5BD248 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BD248 second address: 5BD24E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BD9CE second address: 5BD9EC instructions: 0x00000000 rdtsc 0x00000002 jg 00007FA198D6658Ch 0x00000008 jnc 00007FA198D66586h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 push eax 0x00000015 push edx 0x00000016 jo 00007FA198D66588h 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BDAE3 second address: 5BDAED instructions: 0x00000000 rdtsc 0x00000002 js 00007FA198D78876h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BDAED second address: 5BDB0C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FA198D6658Fh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BDB0C second address: 5BDB16 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FA198D78876h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BDB16 second address: 5BDB33 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA198D66599h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C4883 second address: 5C4888 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C4888 second address: 5C488E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C3D1F second address: 5C3D3C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA198D78884h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C3D3C second address: 5C3D9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push edx 0x00000006 jmp 00007FA198D6658Ch 0x0000000b pop edx 0x0000000c pushad 0x0000000d jmp 00007FA198D66595h 0x00000012 jmp 00007FA198D66597h 0x00000017 jne 00007FA198D66586h 0x0000001d push edx 0x0000001e pop edx 0x0000001f popad 0x00000020 popad 0x00000021 jnp 00007FA198D665A7h 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007FA198D6658Fh 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C3D9D second address: 5C3DA7 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FA198D78876h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C407C second address: 5C4082 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C4082 second address: 5C4086 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C4086 second address: 5C4094 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007FA198D6658Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C446B second address: 5C446F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C45EC second address: 5C45F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C45F0 second address: 5C45F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C45F4 second address: 5C45FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C4731 second address: 5C4737 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C4737 second address: 5C473D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C9F6A second address: 5C9F74 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FA198D78876h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C9F74 second address: 5C9FB8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA198D66599h 0x00000007 jmp 00007FA198D66599h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jc 00007FA198D6659Ch 0x00000014 jbe 00007FA198D6658Ch 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C9FB8 second address: 5C9FC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push edi 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C8C26 second address: 5C8C2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C8C2C second address: 5C8C36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C8DBA second address: 5C8DDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FA198D6658Eh 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pop eax 0x00000010 jmp 00007FA198D6658Dh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C8DDF second address: 5C8E05 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FA198D78885h 0x0000000b ja 00007FA198D78878h 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C8F7A second address: 5C8F7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C8F7E second address: 5C8FBC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA198D78884h 0x00000007 jmp 00007FA198D7887Ch 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ecx 0x0000000f jmp 00007FA198D78882h 0x00000014 jnp 00007FA198D78876h 0x0000001a pop ecx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C9267 second address: 5C926D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C9404 second address: 5C9432 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FA198D78882h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jnc 00007FA198D7887Ah 0x00000013 jmp 00007FA198D7887Bh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C8967 second address: 5C8971 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C8971 second address: 5C8987 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA198D78880h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 591DF9 second address: 591DFD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 591DFD second address: 591E03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5922F5 second address: 592314 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA198D6658Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushad 0x0000000c push eax 0x0000000d pop eax 0x0000000e push edx 0x0000000f pop edx 0x00000010 popad 0x00000011 jo 00007FA198D6658Ch 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 592314 second address: 3E3D2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 mov ecx, dword ptr [ebp+122D397Dh] 0x0000000c push dword ptr [ebp+122D00E1h] 0x00000012 push 00000000h 0x00000014 push edx 0x00000015 call 00007FA198D78878h 0x0000001a pop edx 0x0000001b mov dword ptr [esp+04h], edx 0x0000001f add dword ptr [esp+04h], 00000016h 0x00000027 inc edx 0x00000028 push edx 0x00000029 ret 0x0000002a pop edx 0x0000002b ret 0x0000002c mov ch, 23h 0x0000002e call dword ptr [ebp+122D281Bh] 0x00000034 pushad 0x00000035 mov dword ptr [ebp+122D1DBFh], edi 0x0000003b xor eax, eax 0x0000003d stc 0x0000003e mov edx, dword ptr [esp+28h] 0x00000042 jo 00007FA198D7887Eh 0x00000048 jns 00007FA198D78878h 0x0000004e mov dword ptr [ebp+122D3949h], eax 0x00000054 mov dword ptr [ebp+122D1DBFh], esi 0x0000005a mov esi, 0000003Ch 0x0000005f jc 00007FA198D7887Ch 0x00000065 add esi, dword ptr [esp+24h] 0x00000069 cmc 0x0000006a lodsw 0x0000006c jmp 00007FA198D78885h 0x00000071 add eax, dword ptr [esp+24h] 0x00000075 stc 0x00000076 mov ebx, dword ptr [esp+24h] 0x0000007a mov dword ptr [ebp+122D1DBFh], esi 0x00000080 push eax 0x00000081 pushad 0x00000082 jne 00007FA198D7887Ch 0x00000088 pushad 0x00000089 push eax 0x0000008a push edx 0x0000008b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5925E5 second address: 5925E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5927A7 second address: 5927AC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 592D48 second address: 592D56 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnl 00007FA198D66586h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 592D56 second address: 592D5A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 592D5A second address: 592D69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push esi 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 592D69 second address: 592D6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 592D6F second address: 592DA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 mov eax, dword ptr [eax] 0x00000008 jg 00007FA198D665A1h 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 jng 00007FA198D66590h 0x00000018 push eax 0x00000019 push edx 0x0000001a push edx 0x0000001b pop edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 592E1E second address: 592E24 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 592E24 second address: 592E32 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 592E32 second address: 592E36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 592E36 second address: 592E3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 592E3A second address: 592E6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 nop 0x00000008 cmc 0x00000009 lea eax, dword ptr [ebp+12481B4Ah] 0x0000000f jmp 00007FA198D78884h 0x00000014 push eax 0x00000015 push eax 0x00000016 push edx 0x00000017 jne 00007FA198D7887Ch 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 592E6C second address: 592EBC instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FA198D66588h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f xor edi, dword ptr [ebp+122D3B91h] 0x00000015 lea eax, dword ptr [ebp+12481B06h] 0x0000001b push 00000000h 0x0000001d push eax 0x0000001e call 00007FA198D66588h 0x00000023 pop eax 0x00000024 mov dword ptr [esp+04h], eax 0x00000028 add dword ptr [esp+04h], 00000018h 0x00000030 inc eax 0x00000031 push eax 0x00000032 ret 0x00000033 pop eax 0x00000034 ret 0x00000035 mov di, 3FBBh 0x00000039 mov ecx, dword ptr [ebp+122D3A01h] 0x0000003f nop 0x00000040 push eax 0x00000041 push edx 0x00000042 push esi 0x00000043 jnl 00007FA198D66586h 0x00000049 pop esi 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 592EBC second address: 592EE1 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FA198D7887Ch 0x00000008 jnp 00007FA198D78876h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edi 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FA198D78881h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 592EE1 second address: 579D51 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 nop 0x00000008 push ecx 0x00000009 mov edx, dword ptr [ebp+122D3AC9h] 0x0000000f pop edx 0x00000010 call dword ptr [ebp+122D268Ah] 0x00000016 push eax 0x00000017 jl 00007FA198D66588h 0x0000001d pushad 0x0000001e popad 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007FA198D66590h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D165C second address: 5D1668 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D1668 second address: 5D1688 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA198D6658Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push edi 0x0000000d pop edi 0x0000000e jne 00007FA198D66586h 0x00000014 popad 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D1688 second address: 5D168E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D168E second address: 5D1695 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D1695 second address: 5D16AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jmp 00007FA198D78884h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D1817 second address: 5D181B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D181B second address: 5D1821 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D1968 second address: 5D196D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D1AF9 second address: 5D1B05 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 jne 00007FA198D78876h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D1B05 second address: 5D1B3A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA198D66591h 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FA198D6658Bh 0x00000012 jmp 00007FA198D66591h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D1B3A second address: 5D1B4F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA198D78881h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D809A second address: 5D809E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D6A9C second address: 5D6AA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D6AA0 second address: 5D6AA4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D6AA4 second address: 5D6AB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D6AB0 second address: 5D6AB4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D6AB4 second address: 5D6AD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FA198D78881h 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D6AD0 second address: 5D6AD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D6AD6 second address: 5D6AE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 ja 00007FA198D78876h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D6D7E second address: 5D6D97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FA198D66586h 0x0000000a jp 00007FA198D66586h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jnp 00007FA198D66586h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D6D97 second address: 5D6D9D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D6F31 second address: 5D6F49 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA198D6658Eh 0x00000007 jl 00007FA198D6658Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D736A second address: 5D7370 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D7370 second address: 5D7381 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA198D6658Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D7381 second address: 5D738A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D765D second address: 5D7665 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D7665 second address: 5D7679 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FA198D78886h 0x00000008 jmp 00007FA198D7887Ah 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D77EC second address: 5D77F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D77F0 second address: 5D77F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D77F6 second address: 5D7806 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 ja 00007FA198D66586h 0x00000009 pushad 0x0000000a popad 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D7806 second address: 5D780C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D780C second address: 5D7810 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D7B08 second address: 5D7B18 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FA198D78878h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D7B18 second address: 5D7B26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FA198D66586h 0x0000000a pop ecx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DA7C3 second address: 5DA7D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jng 00007FA198D7887Eh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DA7D0 second address: 5DA7D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DA7D6 second address: 5DA7DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DA7DC second address: 5DA7E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55637C second address: 556386 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FA198D78876h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 556386 second address: 556396 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FA198D66586h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 556396 second address: 5563A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007FA198D78876h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5563A0 second address: 5563A6 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5563A6 second address: 5563B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5563B2 second address: 5563B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DFC0F second address: 5DFC54 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FA198D7887Ah 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 ja 00007FA198D78876h 0x00000016 pushad 0x00000017 popad 0x00000018 jng 00007FA198D78876h 0x0000001e popad 0x0000001f push ecx 0x00000020 jmp 00007FA198D78889h 0x00000025 jp 00007FA198D78876h 0x0000002b pop ecx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DFDBF second address: 5DFDDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA198D66597h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DFDDA second address: 5DFE0B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA198D7887Dh 0x00000007 jmp 00007FA198D7887Dh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jmp 00007FA198D78883h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E00B0 second address: 5E00F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FA198D66586h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d ja 00007FA198D6658Eh 0x00000013 jne 00007FA198D665A4h 0x00000019 js 00007FA198D6658Ch 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E23DD second address: 5E23E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E23E1 second address: 5E23EE instructions: 0x00000000 rdtsc 0x00000002 js 00007FA198D66586h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E23EE second address: 5E23FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FA198D78876h 0x0000000a push edi 0x0000000b pop edi 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E23FB second address: 5E241A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA198D66595h 0x00000009 je 00007FA198D66586h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E6514 second address: 5E6518 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E6518 second address: 5E6524 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jc 00007FA198D66586h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E6524 second address: 5E652A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E652A second address: 5E6530 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E5B0D second address: 5E5B17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FA198D78876h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E5B17 second address: 5E5B2F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA198D66592h 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E5B2F second address: 5E5B35 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E5B35 second address: 5E5B3F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E5B3F second address: 5E5B43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E5B43 second address: 5E5B7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA198D6658Dh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jp 00007FA198D6658Eh 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FA198D66595h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E5B7F second address: 5E5B85 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E5D32 second address: 5E5D40 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E5D40 second address: 5E5D48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E5D48 second address: 5E5D66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA198D66599h 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EAE60 second address: 5EAE7A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007FA198D7887Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EAE7A second address: 5EAE7E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EAE7E second address: 5EAEAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 jp 00007FA198D788BAh 0x0000000f jmp 00007FA198D78887h 0x00000014 push eax 0x00000015 push edx 0x00000016 js 00007FA198D78876h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EAEAE second address: 5EAEB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EB028 second address: 5EB03C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 jmp 00007FA198D7887Ch 0x0000000c pop edi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EB03C second address: 5EB041 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EB041 second address: 5EB06D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop esi 0x00000007 je 00007FA198D78883h 0x0000000d jmp 00007FA198D7887Dh 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FA198D7887Eh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EB1D4 second address: 5EB1DE instructions: 0x00000000 rdtsc 0x00000002 jng 00007FA198D66586h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F11C3 second address: 5F11FB instructions: 0x00000000 rdtsc 0x00000002 jl 00007FA198D7887Eh 0x00000008 jmp 00007FA198D7887Eh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push edi 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 pop edi 0x00000015 js 00007FA198D78882h 0x0000001b jbe 00007FA198D78876h 0x00000021 jnc 00007FA198D78876h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F00C5 second address: 5F00C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F037F second address: 5F03AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA198D78882h 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FA198D78881h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F03AA second address: 5F03AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F81C4 second address: 5F81E3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FA198D78880h 0x00000008 jmp 00007FA198D7887Ah 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F81E3 second address: 5F81E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F8B96 second address: 5F8B9C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F8B9C second address: 5F8BA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F94A7 second address: 5F94B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F94B0 second address: 5F94B6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F94B6 second address: 5F94BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F94BC second address: 5F94C3 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F97C7 second address: 5F97CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F97CD second address: 5F97D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F97D1 second address: 5F97F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push edx 0x0000000a js 00007FA198D78876h 0x00000010 jmp 00007FA198D7887Ah 0x00000015 pop edx 0x00000016 jns 00007FA198D7887Ch 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FE899 second address: 5FE8BA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007FA198D66586h 0x00000009 pushad 0x0000000a popad 0x0000000b push edx 0x0000000c pop edx 0x0000000d jmp 00007FA198D66590h 0x00000012 popad 0x00000013 push ecx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FE8BA second address: 5FE90A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 push esi 0x00000009 jc 00007FA198D78876h 0x0000000f jmp 00007FA198D7887Fh 0x00000014 pop esi 0x00000015 pushad 0x00000016 pushad 0x00000017 popad 0x00000018 jmp 00007FA198D7887Ah 0x0000001d jmp 00007FA198D78884h 0x00000022 popad 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007FA198D7887Bh 0x0000002a push edi 0x0000002b pop edi 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FE90A second address: 5FE916 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FE916 second address: 5FE91A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FE91A second address: 5FE91E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 601AD8 second address: 601AE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 601AE5 second address: 601AEB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 601AEB second address: 601B08 instructions: 0x00000000 rdtsc 0x00000002 js 00007FA198D78876h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jno 00007FA198D7887Ah 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 push esi 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 601B08 second address: 601B10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 601B10 second address: 601B15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 601C93 second address: 601CEE instructions: 0x00000000 rdtsc 0x00000002 jg 00007FA198D66586h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FA198D66599h 0x00000011 je 00007FA198D66595h 0x00000017 jmp 00007FA198D6658Fh 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f jng 00007FA198D6659Ah 0x00000025 jmp 00007FA198D66594h 0x0000002a push edx 0x0000002b push eax 0x0000002c pop eax 0x0000002d pop edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 601CEE second address: 601CFF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA198D7887Bh 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60225C second address: 60226A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FA198D66586h 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60226A second address: 60226F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 609DE8 second address: 609E0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c jmp 00007FA198D66599h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 609F56 second address: 609F6F instructions: 0x00000000 rdtsc 0x00000002 jng 00007FA198D78876h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FA198D7887Ah 0x00000011 push esi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 609F6F second address: 609F84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FA198D66586h 0x0000000a pop esi 0x0000000b popad 0x0000000c jo 00007FA198D6658Eh 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60A3A8 second address: 60A3D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 jc 00007FA198D78876h 0x0000000c pop ecx 0x0000000d pop esi 0x0000000e jbe 00007FA198D7889Eh 0x00000014 jp 00007FA198D7887Eh 0x0000001a pushad 0x0000001b jns 00007FA198D78876h 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60A3D3 second address: 60A3D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60AE2E second address: 60AE37 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edx 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60AE37 second address: 60AE42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60AE42 second address: 60AE71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push edi 0x00000006 jmp 00007FA198D78880h 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e jc 00007FA198D78876h 0x00000014 jmp 00007FA198D78880h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6094D1 second address: 6094D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6094D5 second address: 6094E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007FA198D78888h 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6123E7 second address: 6123FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FA198D6658Ch 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6123FB second address: 612404 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 621343 second address: 62137F instructions: 0x00000000 rdtsc 0x00000002 je 00007FA198D66586h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FA198D66599h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FA198D66594h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62137F second address: 621392 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA198D7887Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6240D3 second address: 6240DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 623C67 second address: 623C86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FA198D78886h 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6259E6 second address: 6259FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jl 00007FA198D6658Ah 0x0000000b push eax 0x0000000c pop eax 0x0000000d push edx 0x0000000e pop edx 0x0000000f pop edi 0x00000010 push eax 0x00000011 push edx 0x00000012 push ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6259FB second address: 625A13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FA198D78876h 0x0000000a pop ebx 0x0000000b jmp 00007FA198D7887Dh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 625A13 second address: 625A25 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FA198D6658Bh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 625A25 second address: 625A32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jc 00007FA198D78876h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 627015 second address: 62703F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA198D66591h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FA198D66595h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62E4FC second address: 62E503 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63674C second address: 63676F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA198D66595h 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d jns 00007FA198D66586h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63676F second address: 636788 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA198D78885h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 636788 second address: 636797 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jng 00007FA198D66586h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63DAFF second address: 63DB09 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007FA198D78876h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63DB09 second address: 63DB42 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007FA198D6658Bh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e push eax 0x0000000f jnl 00007FA198D66586h 0x00000015 pop eax 0x00000016 push esi 0x00000017 push ecx 0x00000018 pop ecx 0x00000019 pushad 0x0000001a popad 0x0000001b pop esi 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007FA198D66593h 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63DB42 second address: 63DB46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63DB46 second address: 63DB50 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FA198D66586h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63C502 second address: 63C53F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FA198D78889h 0x0000000b pushad 0x0000000c jmp 00007FA198D7887Dh 0x00000011 jg 00007FA198D78876h 0x00000017 jbe 00007FA198D78876h 0x0000001d popad 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63C7DF second address: 63C7EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop ecx 0x00000006 jne 00007FA198D665ADh 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63C7EE second address: 63C7F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63CCF7 second address: 63CCFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63CCFB second address: 63CD23 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA198D78883h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a push edi 0x0000000b pop edi 0x0000000c push edx 0x0000000d pop edx 0x0000000e pop edx 0x0000000f pop ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 je 00007FA198D78878h 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63CD23 second address: 63CD2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007FA198D66586h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63D830 second address: 63D85D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push esi 0x00000006 pop esi 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 popad 0x0000000a jmp 00007FA198D78887h 0x0000000f pop edx 0x00000010 pop eax 0x00000011 jne 00007FA198D78893h 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6416AE second address: 6416BE instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jg 00007FA198D66586h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6416BE second address: 6416C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64120A second address: 641217 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jnc 00007FA198D66586h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 641383 second address: 641387 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64EF42 second address: 64EF48 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64EF48 second address: 64EF4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 653D7B second address: 653D7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67B48F second address: 67B4A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jne 00007FA198D7887Ch 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67B4A6 second address: 67B4AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67B4AB second address: 67B4B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007FA198D78876h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67B75A second address: 67B775 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FA198D6658Ch 0x0000000c jng 00007FA198D66586h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67BEAD second address: 67BECC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA198D78880h 0x00000009 pop eax 0x0000000a pop eax 0x0000000b push edi 0x0000000c jg 00007FA198D7887Eh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67ED14 second address: 67ED1A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67ED1A second address: 67ED3A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a jp 00007FA198D78883h 0x00000010 push esi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67EF98 second address: 67EF9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67EF9D second address: 67EFAC instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pushad 0x0000000d popad 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67EFAC second address: 67EFB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007FA198D66586h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6803F5 second address: 680407 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007FA198D7887Dh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 680407 second address: 68040D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 681FE0 second address: 681FF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jo 00007FA198D78882h 0x0000000d jg 00007FA198D78876h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 681BC0 second address: 681BC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 681BC7 second address: 681BCC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51B0D35 second address: 51B0D3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51B0D3B second address: 51B0D3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51B0D3F second address: 51B0D9F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA198D66593h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test eax, eax 0x0000000d pushad 0x0000000e mov ax, FCDBh 0x00000012 pushfd 0x00000013 jmp 00007FA198D66590h 0x00000018 adc si, CAA8h 0x0000001d jmp 00007FA198D6658Bh 0x00000022 popfd 0x00000023 popad 0x00000024 je 00007FA2097AC563h 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007FA198D66595h 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 596116 second address: 59611B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 3E3CD8 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 3E3D91 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 5878D5 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe TID: 6340

Thread sleep time: -30000s >= -30000s

Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.1744214208.00000000012D0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1744106070.000000000126E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1744304962.00000000012F0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739700886.00000000012D0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739594724.00000000012F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_003C5BB0 LdrInitializeThunk,

0_2_003C5BB0

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: file.exe	String found in binary or memory: clearancek.site
Source: file.exe	String found in binary or memory: licendfilteo.site
Source: file.exe	String found in binary or memory: spirittunek.store
Source: file.exe	String found in binary or memory: bathdoomgaz.store
Source: file.exe	String found in binary or memory: studennotediw.store
Source: file.exe	String found in binary or memory: dissapoiznw.store
Source: file.exe	String found in binary or memory: eaglepawnoy.store
Source: file.exe	String found in binary or memory: mobbipenju.store

Source: file.exe, file.exe, 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: ?Program Manager

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Process Injection	24 Virtualization/Sandbox Evasion	OS Credential Dumping	631 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	LSASS Memory	24 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	4 Obfuscated Files or Information	NTDS	23 System Information Discovery	Distributed Component Object Model	Input Capture	113 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://player.vimeo.com	0%	URL Reputation	safe
https://help.steampowered.com/en/	0%	URL Reputation	safe
https://store.steampowered.com/news/	0%	URL Reputation	safe
https://store.steampowered.com/subscriber_agreement/	0%	URL Reputation	safe
https://www.gstatic.cn/recaptcha/	0%	URL Reputation	safe
http://store.steampowered.com/subscriber_agreement/	0%	URL Reputation	safe
https://recaptcha.net/recaptcha/;	0%	URL Reputation	safe
http://www.valvesoftware.com/legal.htm	0%	URL Reputation	safe
https://store.steampowered.com/stats/	0%	URL Reputation	safe
https://medal.tv	0%	URL Reputation	safe
https://broadcast.st.dl.eccdnx.com	0%	URL Reputation	safe
https://store.steampowered.com/steam_refunds/	0%	URL Reputation	safe
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	0%	URL Reputation	safe
https://login.steampowered.com/	0%	URL Reputation	safe
https://store.steampowered.com/legal/	0%	URL Reputation	safe
https://steam.tv/	0%	URL Reputation	safe
http://store.steampowered.com/privacy_agreement/	0%	URL Reputation	safe
https://steamcommunity.com:443/profiles/76561199724331900	100%	URL Reputation	malware
https://store.steampowered.com/points/shop/	0%	URL Reputation	safe
https://recaptcha.net	0%	URL Reputation	safe
https://store.steampowered.com/	0%	URL Reputation	safe
https://lv.queniujq.cn	0%	URL Reputation	safe
https://store.steampowered.com/privacy_agreement/	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	0%	URL Reputation	safe
https://checkout.steampowered.com/	0%	URL Reputation	safe
https://help.steampowered.com/	0%	URL Reputation	safe
https://api.steampowered.com/	0%	URL Reputation	safe
http://store.steampowered.com/account/cookiepreferences/	0%	URL Reputation	safe
https://store.steampowered.com/mobile	0%	URL Reputation	safe
https://store.steampowered.com/;	0%	URL Reputation	safe
https://store.steampowered.com/about/	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
steamcommunity.com	104.102.49.254	true	true	unknown
eaglepawnoy.store	unknown	unknown	true	unknown
bathdoomgaz.store	unknown	unknown	true	unknown
spirittunek.store	unknown	unknown	true	unknown
licendfilteo.site	unknown	unknown	true	unknown
studennotediw.store	unknown	unknown	true	unknown
mobbipenju.store	unknown	unknown	true	unknown
clearancek.site	unknown	unknown	true	unknown
dissapoiznw.store	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Reputation
bathdoomgaz.store	true	unknown
studennotediw.store	true	unknown
clearancek.site	true	unknown
dissapoiznw.store	true	unknown
https://steamcommunity.com/profiles/76561199724331900	true	unknown
spirittunek.store	true	unknown
licendfilteo.site	true	unknown
eaglepawnoy.store	true	unknown
mobbipenju.store	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://steamcommunity.com/my/wishlist/	file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://player.vimeo.com	file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1744384288.00000000012FB000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC&	file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/?subsection=broadcasts	file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://help.steampowered.com/en/	file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_global.js?v=wJD9maDpDcV	file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/market/	file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/news/	file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/subscriber_agreement/	file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.gstatic.cn/recaptcha/	file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1744384288.00000000012FB000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://store.steampowered.com/subscriber_agreement/	file.exe, 00000000.00000002.1744214208.00000000012D0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739700886.00000000012D0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/applications/community/manifest.js?v=	file.exe, 00000000.00000002.1744214208.00000000012D0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739700886.00000000012D0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	file.exe, 00000000.00000002.1744214208.00000000012D0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739700886.00000000012D0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://clearancek.site:443/apiin	file.exe, 00000000.00000002.1744214208.00000000012AF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739700886.00000000012AF000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/css/applications/community/main.css?v=ljhW-PbGuX	file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://recaptcha.net/recaptcha/;	file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1744384288.00000000012FB000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpE	file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.valvesoftware.com/legal.htm	file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/discussions/	file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.youtube.com	file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1744384288.00000000012FB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.google.com	file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1744384288.00000000012FB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/stats/	file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/global.js?v=bOP7RorZq4_W&l=englis	file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://medal.tv	file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1744384288.00000000012FB000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://broadcast.st.dl.eccdnx.com	file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1744384288.00000000012FB000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0&amp	file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/steam_refunds/	file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v	file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.p	file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	file.exe, 00000000.00000003.1739594724.00000000012DF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900	file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1	file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://s.ytimg.com;	file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1744384288.00000000012FB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/workshop/	file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://login.steampowered.com/	file.exe, 00000000.00000002.1744384288.00000000012FB000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/7	file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/legal/	file.exe, 00000000.00000002.1744214208.00000000012D0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739700886.00000000012D0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steam.tv/	file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1744384288.00000000012FB000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/css/buttons.css?v=tuNiaSwXwcYT&l=engl	file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/css/motiva_sans.css?v=GfSjbGKcNYaQ&l=	file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/javascript/applications/community/main.js?v=W9BX	file.exe, 00000000.00000002.1744214208.00000000012D0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739700886.00000000012D0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw&	file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/css/globalv2.css?v=pwVcIAtHNXwg&l=english&am	file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://store.steampowered.com/privacy_agreement/	file.exe, 00000000.00000002.1744214208.00000000012D0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739700886.00000000012D0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Cb9e7f3651c38ac4	file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/css/shared_responsive.css?v=eghn9DNyCY67&	file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com:443/profiles/76561199724331900	file.exe, 00000000.00000002.1744214208.00000000012AF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739700886.00000000012AF000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
https://community.cloudflare.steamstatic.com/public/css/skin_1/header.css?v=vh4BMeDcNiCU&l=engli	file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/points/shop/	file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://recaptcha.net	file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1744384288.00000000012FB000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://mobbipenju.store:443/apiv	file.exe, 00000000.00000002.1744214208.00000000012AF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739700886.00000000012AF000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/	file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/css/skin_1/fatalerror.css?v=wctRWaBvNt2z&l=e	file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://clearancek.site:443/apiW	file.exe, 00000000.00000002.1744214208.00000000012AF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739700886.00000000012AF000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com	file.exe, 00000000.00000002.1744214208.00000000012D0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739700886.00000000012D0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://studennotediw.store:443/api	file.exe, 00000000.00000002.1744214208.00000000012AF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739700886.00000000012AF000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/css/shared_global.css?v=Ff_1prscqzeu&	file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://sketchfab.com	file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1744384288.00000000012FB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://lv.queniujq.cn	file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1744384288.00000000012FB000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.youtube.com/	file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1744384288.00000000012FB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://127.0.0.1:27060	file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1744384288.00000000012FB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/privacy_agreement/	file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/	file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1744384288.00000000012FB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	file.exe, 00000000.00000002.1744214208.00000000012D0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739700886.00000000012D0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://spirittunek.store:443/api	file.exe, 00000000.00000002.1744214208.00000000012AF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739700886.00000000012AF000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/recaptcha/	file.exe, 00000000.00000002.1744384288.00000000012FB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://checkout.steampowered.com/	file.exe, 00000000.00000002.1744384288.00000000012FB000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://help.steampowered.com/	file.exe, 00000000.00000002.1744384288.00000000012FB000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.steampowered.com/	file.exe, 00000000.00000002.1744384288.00000000012FB000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/applications/community/libraries~b28b	file.exe, 00000000.00000002.1744214208.00000000012D0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739700886.00000000012D0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://store.steampowered.com/account/cookiepreferences/	file.exe, 00000000.00000002.1744214208.00000000012D0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739700886.00000000012D0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_logo.png	file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/mobile	file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/	file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/;	file.exe, 00000000.00000003.1739774093.00000000012FB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1739564446.0000000001332000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1744384288.00000000012FB000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/about/	file.exe, 00000000.00000003.1739805715.000000000133E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/	file.exe, 00000000.00000002.1744384288.00000000012FB000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.102.49.254	steamcommunity.com	United States		16625	AKAMAI-ASUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1540503
Start date and time:	2024-10-23 20:53:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 40s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	1
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@9/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
14:54:00	API Interceptor	2x Sleep call for process: file.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.102.49.254	http://gtm-cn-j4g3qqvf603.steamproxy1.com/	Get hash	malicious	Unknown	Browse	www.valvesoftware.com/legal.htm

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
steamcommunity.com	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.102.49.254
	xxJfSec58P.exe	Get hash	malicious	Vidar	Browse	104.102.49.254
	UMrFwHyjUi.exe	Get hash	malicious	Vidar	Browse	92.122.104.90
	b157p9L0c1.exe	Get hash	malicious	Vidar	Browse	104.102.49.254
	PFlJLzFUqH.exe	Get hash	malicious	Vidar	Browse	104.102.49.254
	46QSz6qyKC.exe	Get hash	malicious	Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.102.49.254

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASUS	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	104.102.49.254
	m68k.elf	Get hash	malicious	Unknown	Browse	23.210.234.207
	la.bot.m68k.elf	Get hash	malicious	Unknown	Browse	23.2.77.205
	KERR SURVEYING LLC EE RFI#1.pdf	Get hash	malicious	Unknown	Browse	184.28.88.176
	la.bot.sparc.elf	Get hash	malicious	Unknown	Browse	23.7.233.67
	mips.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	104.79.147.36
	la.bot.powerpc.elf	Get hash	malicious	Unknown	Browse	72.246.29.1
	https://www.pumpproducts.com/goulds-lb0735te-centrifugal-booster-pump-3-4-hp-208-230-460-volts-3-phase-1-1-4-npt-suction-1-npt-discharge-18-gpm-max-176-ft-max-head-5-impeller-tefc-stainless-steel-pump-end-casing.html	Get hash	malicious	Unknown	Browse	104.102.19.45
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.102.49.254

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.102.49.254
	044SqLy1H3.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	wRcmIT6Eji.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	qfq0JTpoq9.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	W1WowSI1iG.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	o9rbdhliSW.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	mh3FCXkJXk.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	wXtaX552wr.exe	Get hash	malicious	LummaC	Browse	104.102.49.254

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.513474151702093
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'974'208 bytes
MD5:	81a343f401c4d91848fcd321415da84d
SHA1:	5dddc1821c371c7c2eb98dc8d80379f93088b3b8
SHA256:	1cbd31dee64216130c84c78a046e0f0733618459f7288f7e024431167bb7ad75
SHA512:	cf008a8b0353fc2b35930a7b09a3bdac1ae89a5150ff1983e25d4fd9fcf751f3fc326560246e2f3d344d85b5a3fc6ca6a0b3d21dccc080d94d363689701f1c64
SSDEEP:	49152:9Lg/2nj9ZN5gmpZJ8Ex6eHgSLNmwVtqF4PwONd9+:9c/2jvNum/J8NWgWNmwVtDfN
TLSH:	0BD52AB2B60561CBD88E2774992BCD82BA5E03B9472448D39C6C74FA7EB7DC112F5C24
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...J..f..............................0...........@...........................1.......-...@.................................W...k..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x70e000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66FFF14A [Fri Oct 4 13:44:42 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FA1987EECAAh
cmovo ebp, dword ptr [00000000h]
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [ebx], cl
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 0Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or byte ptr [eax+00000000h], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
sub byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or al, 80h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+00000000h], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5f057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x5f1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x5d000	0x25e00	944011fce4211b6acb2519e29cdc746a	False	0.9993425123762376	data	7.976192682340559	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x5e000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x5f000	0x1000	0x200	fe72def8b74193a84232a780098a7ce0	False	0.150390625	data	1.04205214219471	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
mcrbadlk	0x60000	0x2ad000	0x2acc00	48edb21795b7ccb64fe9f318fd8f3e52	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
rfimzgrw	0x30d000	0x1000	0x400	64a62400534eaa3f4cba090de675c846	False	0.7958984375	data	6.157129711463638	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x30e000	0x3000	0x2200	73079d2ea8756f48ede9e15336032d0a	False	0.06985294117647059	DOS executable (COM)	0.7768156723685585	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-23T20:54:01.664691+0200	2056471	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)	1	192.168.2.4	56995	1.1.1.1	53	UDP
2024-10-23T20:54:01.677229+0200	2056485	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)	1	192.168.2.4	56422	1.1.1.1	53	UDP
2024-10-23T20:54:01.691573+0200	2056483	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)	1	192.168.2.4	51157	1.1.1.1	53	UDP
2024-10-23T20:54:01.704103+0200	2056481	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)	1	192.168.2.4	50259	1.1.1.1	53	UDP
2024-10-23T20:54:01.720070+0200	2056479	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)	1	192.168.2.4	62493	1.1.1.1	53	UDP
2024-10-23T20:54:01.735767+0200	2056477	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)	1	192.168.2.4	53449	1.1.1.1	53	UDP
2024-10-23T20:54:01.751402+0200	2056475	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)	1	192.168.2.4	61328	1.1.1.1	53	UDP
2024-10-23T20:54:01.767236+0200	2056473	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)	1	192.168.2.4	51770	1.1.1.1	53	UDP
2024-10-23T20:54:03.801135+0200	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.4	49730	104.102.49.254	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 23, 2024 20:54:01.803792000 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 23, 2024 20:54:01.803891897 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 23, 2024 20:54:01.804197073 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 23, 2024 20:54:01.806950092 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 23, 2024 20:54:01.807003021 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 23, 2024 20:54:02.865921021 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 23, 2024 20:54:02.866009951 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 23, 2024 20:54:02.869373083 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 23, 2024 20:54:02.869422913 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 23, 2024 20:54:02.869853020 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 23, 2024 20:54:02.916460991 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 23, 2024 20:54:02.963368893 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 23, 2024 20:54:03.801254034 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 23, 2024 20:54:03.801317930 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 23, 2024 20:54:03.801361084 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 23, 2024 20:54:03.801361084 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 23, 2024 20:54:03.801381111 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 23, 2024 20:54:03.801415920 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 23, 2024 20:54:03.801420927 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 23, 2024 20:54:03.801435947 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 23, 2024 20:54:03.801450968 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 23, 2024 20:54:03.801512003 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 23, 2024 20:54:03.801512003 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 23, 2024 20:54:04.775639057 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 23, 2024 20:54:04.775656939 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 23, 2024 20:54:04.775679111 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 23, 2024 20:54:04.775738955 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 23, 2024 20:54:04.775763988 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 23, 2024 20:54:04.775799990 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 23, 2024 20:54:04.775825024 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 23, 2024 20:54:04.778969049 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 23, 2024 20:54:04.779011011 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 23, 2024 20:54:04.779040098 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 23, 2024 20:54:04.779056072 CEST	443	49730	104.102.49.254	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 23, 2024 20:54:01.664690971 CEST	56995	53	192.168.2.4	1.1.1.1
Oct 23, 2024 20:54:01.675918102 CEST	53	56995	1.1.1.1	192.168.2.4
Oct 23, 2024 20:54:01.677228928 CEST	56422	53	192.168.2.4	1.1.1.1
Oct 23, 2024 20:54:01.689120054 CEST	53	56422	1.1.1.1	192.168.2.4
Oct 23, 2024 20:54:01.691572905 CEST	51157	53	192.168.2.4	1.1.1.1
Oct 23, 2024 20:54:01.701862097 CEST	53	51157	1.1.1.1	192.168.2.4
Oct 23, 2024 20:54:01.704102993 CEST	50259	53	192.168.2.4	1.1.1.1
Oct 23, 2024 20:54:01.717256069 CEST	53	50259	1.1.1.1	192.168.2.4
Oct 23, 2024 20:54:01.720069885 CEST	62493	53	192.168.2.4	1.1.1.1
Oct 23, 2024 20:54:01.733643055 CEST	53	62493	1.1.1.1	192.168.2.4
Oct 23, 2024 20:54:01.735766888 CEST	53449	53	192.168.2.4	1.1.1.1
Oct 23, 2024 20:54:01.749209881 CEST	53	53449	1.1.1.1	192.168.2.4
Oct 23, 2024 20:54:01.751401901 CEST	61328	53	192.168.2.4	1.1.1.1
Oct 23, 2024 20:54:01.764806032 CEST	53	61328	1.1.1.1	192.168.2.4
Oct 23, 2024 20:54:01.767235994 CEST	51770	53	192.168.2.4	1.1.1.1
Oct 23, 2024 20:54:01.776566029 CEST	53	51770	1.1.1.1	192.168.2.4
Oct 23, 2024 20:54:01.789128065 CEST	63252	53	192.168.2.4	1.1.1.1
Oct 23, 2024 20:54:01.798650026 CEST	53	63252	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 23, 2024 20:54:01.664690971 CEST	192.168.2.4	1.1.1.1	0x9020	Standard query (0)	clearancek.site	A (IP address)	IN (0x0001)	false
Oct 23, 2024 20:54:01.677228928 CEST	192.168.2.4	1.1.1.1	0x3292	Standard query (0)	mobbipenju.store	A (IP address)	IN (0x0001)	false
Oct 23, 2024 20:54:01.691572905 CEST	192.168.2.4	1.1.1.1	0xde92	Standard query (0)	eaglepawnoy.store	A (IP address)	IN (0x0001)	false
Oct 23, 2024 20:54:01.704102993 CEST	192.168.2.4	1.1.1.1	0x6ebf	Standard query (0)	dissapoiznw.store	A (IP address)	IN (0x0001)	false
Oct 23, 2024 20:54:01.720069885 CEST	192.168.2.4	1.1.1.1	0x3624	Standard query (0)	studennotediw.store	A (IP address)	IN (0x0001)	false
Oct 23, 2024 20:54:01.735766888 CEST	192.168.2.4	1.1.1.1	0x52c1	Standard query (0)	bathdoomgaz.store	A (IP address)	IN (0x0001)	false
Oct 23, 2024 20:54:01.751401901 CEST	192.168.2.4	1.1.1.1	0x5a13	Standard query (0)	spirittunek.store	A (IP address)	IN (0x0001)	false
Oct 23, 2024 20:54:01.767235994 CEST	192.168.2.4	1.1.1.1	0x1d97	Standard query (0)	licendfilteo.site	A (IP address)	IN (0x0001)	false
Oct 23, 2024 20:54:01.789128065 CEST	192.168.2.4	1.1.1.1	0x82b2	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 23, 2024 20:54:01.675918102 CEST	1.1.1.1	192.168.2.4	0x9020	Name error (3)	clearancek.site	none	none	A (IP address)	IN (0x0001)	false
Oct 23, 2024 20:54:01.689120054 CEST	1.1.1.1	192.168.2.4	0x3292	Name error (3)	mobbipenju.store	none	none	A (IP address)	IN (0x0001)	false
Oct 23, 2024 20:54:01.701862097 CEST	1.1.1.1	192.168.2.4	0xde92	Name error (3)	eaglepawnoy.store	none	none	A (IP address)	IN (0x0001)	false
Oct 23, 2024 20:54:01.717256069 CEST	1.1.1.1	192.168.2.4	0x6ebf	Name error (3)	dissapoiznw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 23, 2024 20:54:01.733643055 CEST	1.1.1.1	192.168.2.4	0x3624	Name error (3)	studennotediw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 23, 2024 20:54:01.749209881 CEST	1.1.1.1	192.168.2.4	0x52c1	Name error (3)	bathdoomgaz.store	none	none	A (IP address)	IN (0x0001)	false
Oct 23, 2024 20:54:01.764806032 CEST	1.1.1.1	192.168.2.4	0x5a13	Name error (3)	spirittunek.store	none	none	A (IP address)	IN (0x0001)	false
Oct 23, 2024 20:54:01.776566029 CEST	1.1.1.1	192.168.2.4	0x1d97	Name error (3)	licendfilteo.site	none	none	A (IP address)	IN (0x0001)	false
Oct 23, 2024 20:54:01.798650026 CEST	1.1.1.1	192.168.2.4	0x82b2	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	104.102.49.254	443	6944	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-23 18:54:02 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-10-23 18:54:03 UTC	1917	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https:// [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Wed, 23 Oct 2024 18:54:03 GMT Content-Length: 26105 Connection: close Set-Cookie: sessionid=1d20356a57eb04100980c006; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cb9e7f3651c38ac41ccf738a8ba3498dc; Path=/; Secure; HttpOnly; SameSite=None
2024-10-23 18:54:03 UTC	14467	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-10-23 18:54:04 UTC	11638	IN	Data Raw: 22 3f 6c 3d 74 63 68 69 6e 65 73 65 22 20 6f 6e 63 6c 69 63 6b 3d 22 43 68 61 6e 67 65 4c 61 6e 67 75 61 67 65 28 20 27 74 63 68 69 6e 65 73 65 27 20 29 3b 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 22 3e e7 b9 81 e9 ab 94 e4 b8 ad e6 96 87 20 28 54 72 61 64 69 74 69 6f 6e 61 6c 20 43 68 69 6e 65 73 65 29 3c 2f 61 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 6d 65 6e 75 5f 69 74 65 6d 20 74 69 67 68 74 22 20 68 72 65 66 3d 22 3f 6c 3d 6a 61 70 61 6e 65 73 65 22 20 6f 6e 63 6c 69 63 6b 3d 22 43 68 61 6e 67 65 4c 61 6e 67 75 61 67 65 28 20 27 6a 61 70 61 6e 65 73 65 27 20 29 3b 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 22 3e e6 97 a5 e6 9c ac e8 aa 9e 20 28 4a Data Ascii: "?l=tchinese" onclick="ChangeLanguage( 'tchinese' ); return false;"> (Traditional Chinese)</a><a class="popup_menu_item tight" href="?l=japanese" onclick="ChangeLanguage( 'japanese' ); return false;"> (J

Target ID:	0
Start time:	14:53:59
Start date:	23/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x380000
File size:	2'974'208 bytes
MD5 hash:	81A343F401C4D91848FCD321415DA84D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	71.4%
Total number of Nodes:	42
Total number of Limit Nodes:	5

Executed Functions

Function 0038FCA0 Relevance: 5.4, Strings: 4, Instructions: 373
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

t, xrefs: 0038FCBE
VY^_, xrefs: 0038FDFF
V, xrefs: 0038FEDC
J|BJ, xrefs: 0039000D

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID: J|BJ$V$VY^_$t
API String ID: 0-3701112211
Opcode ID: 68b73b3c10529bbb086e3ca5a56c3753d26c9eec2a7fb7273ead6e947be9052c
Instruction ID: eef975ae27053f34b4dc1f526d2e61e5429afbe1d51912598093a48c476ab623
Opcode Fuzzy Hash: 68b73b3c10529bbb086e3ca5a56c3753d26c9eec2a7fb7273ead6e947be9052c
Instruction Fuzzy Hash: 3FD1767850C3909FD716DF18949062FBBE2AB92B44F18886CF4D99B252C336CD09DB92

Function 0038D110 Relevance: 1.7, APIs: 1, Instructions: 168
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(00000000), ref: 0038D2F1

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 8c6b22f8120e79f6904e8786676d98f9b6593d0532d7371f00b3bb21ac348112
Instruction ID: 2f37f936d9050bbb93f3886efb0d4f3598ce327e531bae45b69587765b20242e
Opcode Fuzzy Hash: 8c6b22f8120e79f6904e8786676d98f9b6593d0532d7371f00b3bb21ac348112
Instruction Fuzzy Hash: BC41687440D340ABD702BB68D598E2EFBF5AF92704F148C8CE5C49B292C336D8108B67

Function 003C5700 Relevance: 1.6, APIs: 1, Instructions: 69
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlReAllocateHeap.NTDLL(?,00000000,?,?), ref: 003C5784

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 1a4c77f7898d4f14c4e00299c24bbc79c3845a0916bd345e02ba635fb88bd593
Instruction ID: 76c8d3318bff79a1d9dc11abbf6ea8136a5d636268b1e913f2e8c0d7ada8babb
Opcode Fuzzy Hash: 1a4c77f7898d4f14c4e00299c24bbc79c3845a0916bd345e02ba635fb88bd593
Instruction Fuzzy Hash: 09114C7591D240EBC302AF28E845E1BBBE9AF96710F05882CE484DB211D735ED55CB93

Function 003C5BB0 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(003C973D,005C003F,00000006,?,?,00000018,8C8D8A8B,?,?), ref: 003C5BDE

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction ID: fb6f357373f259be8b0e83fffc5d2a3912a28e0da7d2036ce94b71e982b3a7e9
Opcode Fuzzy Hash: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction Fuzzy Hash: 76E0FE75908316AB9A09CF45C14444EFBE5BFC4714F11CC8DA4D867210D3B0AD46DF82

Function 003C695B Relevance: 1.4, Strings: 1, Instructions: 100
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@, xrefs: 003C69C5

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 9c82d6ecaaaffa0f4cb7bc3a67ad620d17c5b68d659b095c2da7acc8e6de3fcf
Instruction ID: 027394bf6c3fdb95b0f74b53993d0a2c14b7504b66bba44de56bf014946fbfc6
Opcode Fuzzy Hash: 9c82d6ecaaaffa0f4cb7bc3a67ad620d17c5b68d659b095c2da7acc8e6de3fcf
Instruction Fuzzy Hash: FC3196B55183018FD719EF14D8A1B2AB7F5EF88344F18981DE5C6DB2A1E3389904CB56

Function 0039049B Relevance: .3, Instructions: 264
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52b027f779a527284b13e65fe0e8bbdcb33088f935337d241d80f958cc6831e7
Instruction ID: ef83edb2a8158ed6cee6c2c90b6e6be81750ac32d448d0508a85331a77f3d677
Opcode Fuzzy Hash: 52b027f779a527284b13e65fe0e8bbdcb33088f935337d241d80f958cc6831e7
Instruction Fuzzy Hash: E1916975200B00CFD7268F25E894A16B7FAFF89314F118A6DE896CBAA1D731F815CB50

Function 00390228 Relevance: .2, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07f876b61feaa953872413f020932f9e7393860e8ff568c5953f617583afb42f
Instruction ID: 2dbeb42c3909de58e513630f57eabd1f2986b0b037b6064b0806ca261c6656fa
Opcode Fuzzy Hash: 07f876b61feaa953872413f020932f9e7393860e8ff568c5953f617583afb42f
Instruction Fuzzy Hash: 1C716775201B00DFD7268F25EC94E26B7FAFF89714F108969E896CBA62C731B815CB50

Function 003C99D0 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29ed4ce6dfe312000a9526e4253e56e4fb30553d315eab8a5ed3c3b6d93ea01f
Instruction ID: 164cfd10b740dc7c99ed4980002da7a9378c117d9fd0d84c21cd2e5dc3dd8a9e
Opcode Fuzzy Hash: 29ed4ce6dfe312000a9526e4253e56e4fb30553d315eab8a5ed3c3b6d93ea01f
Instruction Fuzzy Hash: 99419234209300ABD716DB15E894F2BB7E9EB85714F26881EF58ADB251D331EC11CB56

Function 003C63B8 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 03c16619e8a6970156ce91c0f952a03d00026161491a51a79c559d5eb11b304c
Instruction ID: 545bd73a929e4b326b988567255bea3c2c6c85f0d3e15415ceaf8060118d9cc4
Opcode Fuzzy Hash: 03c16619e8a6970156ce91c0f952a03d00026161491a51a79c559d5eb11b304c
Instruction Fuzzy Hash: CE31D274649301BBD62ADB05DD83F3AB7A9EB81B11F64851CF1819B2E1D370BC118B56

Function 00390EEC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8f2e713597acd84ec8fff3edc4ae9806c0238daa28d484090da9a1fb1a23992
Instruction ID: 6f8ce208654b96c6fc79712e43463306f530ca197948863a6cdd59ebb7f360eb
Opcode Fuzzy Hash: a8f2e713597acd84ec8fff3edc4ae9806c0238daa28d484090da9a1fb1a23992
Instruction Fuzzy Hash: 45213CB590021A9FDF15CF94CC90BBEBBB6FF46304F144809E412BB291C735A911CB64

Function 003C3220 Relevance: 1.6, APIs: 1, Instructions: 59
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(?,00000000), ref: 003C32A6

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 5698296c20f8d4bc1386d45ac5e400f40afab83cc31b42141ba07b609318ff7d
Instruction ID: 7fedb9a2c1db962e58e6e1b9cd0e2f8a7f5c0dfdf39ab84c2530d9995685d208
Opcode Fuzzy Hash: 5698296c20f8d4bc1386d45ac5e400f40afab83cc31b42141ba07b609318ff7d
Instruction Fuzzy Hash: C4014B3450D2409BC702AF18E945E1ABBE8EF4A700F058D1CE5C58B361D235DD60CB92

Function 003C3202 Relevance: 1.5, APIs: 1, Instructions: 6
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,00000000), ref: 003C3208

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 640c775598f800599a5cb355859b98c2e41ca3ad8daa58537b7393cd56a02ecc
Instruction ID: 7e4f36d5c926c239de4ea1871ddef0c8e6a30ab1c7a4b3a6adca521beb0f7094
Opcode Fuzzy Hash: 640c775598f800599a5cb355859b98c2e41ca3ad8daa58537b7393cd56a02ecc
Instruction Fuzzy Hash: 0BB012304400005FDA051F00FC0AF003614EB00705F800090A100040B1D1615864C554

Non-executed Functions

Function 0039DB6F Relevance: 32.0, Strings: 24, Instructions: 2006COMMON

Download Yara Rule

Strings

AR, xrefs: 0039DD10
%*+(, xrefs: 0039DE37, 0039DE46
T, xrefs: 0039F157
<=2, xrefs: 0039EA01
xgfe, xrefs: 0039E71D
@ONM, xrefs: 0039E6DB
lkji, xrefs: 0039E73E
QNOL, xrefs: 0039E775
|, xrefs: 0039ECB1
89&', xrefs: 0039E93B
`onm, xrefs: 0039E733
mjkh, xrefs: 0039E7D8
WP, xrefs: 0039DCEF
()./, xrefs: 0039E9CA
tsrq, xrefs: 0039E6FC
`Y^_, xrefs: 0039E99E
<=:;, xrefs: 0039E930
89>?, xrefs: 0039E9F6
dcba, xrefs: 0039E728
tuJK, xrefs: 0039E967
:WUE, xrefs: 0039F6B7, 0039F6C6
LKJI, xrefs: 0039E6E6
D, xrefs: 0039E846
DCBA, xrefs: 0039E887, 0039E896

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID: InitializeThunk
String ID: %*+($()./$89&'$89>?$:WUE$<=2$<=:;$@ONM$AR$D$DCBA$LKJI$QNOL$T$WP$`Y^_$`onm$dcba$lkji$mjkh$tsrq$tuJK$xgfe$|
API String ID: 2994545307-1418943773
Opcode ID: 3e0165490315e95da0e2f7f5c223c7f62092eb151b567fce7c493499b883b7ce
Instruction ID: c59feddfbd6a28798e6eef976c1514c189fd6ee01f5a54c1db9767ad3034de2f
Opcode Fuzzy Hash: 3e0165490315e95da0e2f7f5c223c7f62092eb151b567fce7c493499b883b7ce
Instruction Fuzzy Hash: 0BF277B15093819FDB72CF14C884BABBBE6BFD5304F54482DE4C98B252DB359984CB92

Function 003B23E0 Relevance: 31.3, APIs: 4, Strings: 12, Instructions: 3298COMMON

Download Yara Rule

Strings

ggxz, xrefs: 003B2685
`tii, xrefs: 003B2693
fedc, xrefs: 003B2782
f@~!, xrefs: 003B25FF
Cx, xrefs: 003B453D
aenQ, xrefs: 003B276A
|}&C, xrefs: 003B2F21
%*+(, xrefs: 003B40EF
{l`~, xrefs: 003B268C
3<, xrefs: 003B32D6
:, xrefs: 003B32DD
mlc@, xrefs: 003B275C

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID: %*+($3<$:$Cx$`tii$aenQ$f@~!$fedc$ggxz$mlc@${l`~$|}&C
API String ID: 0-786070067
Opcode ID: dd1cd04f139dc4e0c7a5e32a8c655fc67cc51449207c18b87fa2abb381f04aea
Instruction ID: b2fbeda347b028dbf317c1b70132dd20d75ff0df37e1fadb1a7a49f94f8b092c
Opcode Fuzzy Hash: dd1cd04f139dc4e0c7a5e32a8c655fc67cc51449207c18b87fa2abb381f04aea
Instruction Fuzzy Hash: 8C33DF70504B818FD7268F38C5907A3BBE1BF16308F58499DE5DA8BB92C735E906CB61

Function 003A9F62 Relevance: 21.7, Strings: 17, Instructions: 473COMMON

Download Yara Rule

Strings

(a*c, xrefs: 003AA147
kW, xrefs: 003AA380
sm, xrefs: 003AA830
JG, xrefs: 003AAA27
WH, xrefs: 003AAA1C
%e6g, xrefs: 003AA152
hi, xrefs: 003AAB9D
N[, xrefs: 003AA375
Gt, xrefs: 003A9FF8
=], xrefs: 003AA36A
WQ, xrefs: 003AA62B
CG, xrefs: 003AAA32
?m,o, xrefs: 003AA13C
_Y, xrefs: 003AA641
S], xrefs: 003AA636
]{, xrefs: 003AA1E7, 003AA1F3
/), xrefs: 003AA66D

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID: %e6g$(a*c$=]$?m,o$CG$Gt$JG$N[$WH$]{$hi$kW$/)$S]$WQ$_Y$sm
API String ID: 0-1131134755
Opcode ID: 0124517916698f9ee895f6eff720f6432882a5790df3880e9b505d433afcc58b
Instruction ID: 603f66a377952063c314095069d2b3aa69a89378443e9423f6c13023d0eab608
Opcode Fuzzy Hash: 0124517916698f9ee895f6eff720f6432882a5790df3880e9b505d433afcc58b
Instruction Fuzzy Hash: 7252C6B400D385CAE271CF25D581B8EBAF1BB92740F608A1DE1ED9B255DBB08049CF93

Function 003A9510 Relevance: 20.4, Strings: 16, Instructions: 427COMMON

Download Yara Rule

Strings

2A"_, xrefs: 003A9980
z=Q?, xrefs: 003A9826
!E4G, xrefs: 003A9836
O+f), xrefs: 003A9634, 003A963D
8;, xrefs: 003A9B13
L3Y=, xrefs: 003A9B03
B?Q9, xrefs: 003A9B0B
T#a-, xrefs: 003A9AE3
?M0K, xrefs: 003A9968
;IJK, xrefs: 003A983E
X/R), xrefs: 003A9AEB
,A&C, xrefs: 003A982E
G+X5, xrefs: 003A9AF3
pq, xrefs: 003A99E0
B7U1, xrefs: 003A9AFB
G'M!, xrefs: 003A9ADB

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID: !E4G$,A&C$2A"_$8;$;IJK$?M0K$B7U1$B?Q9$G'M!$G+X5$L3Y=$O+f)$T#a-$X/R)$pq$z=Q?
API String ID: 0-655414846
Opcode ID: e1393aa10a31d98b95e0b2405ab800e663a97eef8c64fce1fa3ffc14603c00dd
Instruction ID: 771d30807a8a79abcf6512fc025eafba2ab6c6b32ce26b43668a2b35f8080538
Opcode Fuzzy Hash: e1393aa10a31d98b95e0b2405ab800e663a97eef8c64fce1fa3ffc14603c00dd
Instruction Fuzzy Hash: 66F13EB0508380ABD311DF15D881A2BBBF8FB86B48F144D1DF4D9AB252D334D908CBA6

Function 003ADD29 Relevance: 18.6, Strings: 14, Instructions: 1142COMMON

Download Yara Rule

Strings

:, xrefs: 003AE9C5
:, xrefs: 003AE403, 003AE664, 003AE7BD
hX]N, xrefs: 003ADDC7
<Y.[, xrefs: 003AE27D
%*+(, xrefs: 003AE143
=]+_, xrefs: 003AE276
)IgK, xrefs: 003AE261
r:, xrefs: 003AE92E
,Q?S, xrefs: 003AE26F
Y9N;, xrefs: 003AE245
{E, xrefs: 003AE323
n\+H, xrefs: 003ADDC0
-M2O, xrefs: 003AE25A
upH}, xrefs: 003ADE8A, 003AE798, 003ADF4A

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID: :$%*+($)IgK$,Q?S$-M2O$<Y.[$=]+_$Y9N;$hX]N$n\+H$r:$upH}${E$:
API String ID: 0-3652802789
Opcode ID: 3d011d170d345c9cd22f2d0e6ca1d125dcba75b6f59191b92fc515d44acd3281
Instruction ID: b68b3db625e7b1e10aa8a5cfe134cf8a1bf5fee6553430d98e066a2147c37ec8
Opcode Fuzzy Hash: 3d011d170d345c9cd22f2d0e6ca1d125dcba75b6f59191b92fc515d44acd3281
Instruction Fuzzy Hash: D6922471E00205CFDB09CF68D8917AEBBB6FF4A310F298169E416AB391D735AD01CB90

Function 005568D1 Relevance: 16.6, Strings: 12, Instructions: 1637COMMON

Download Yara Rule

Strings

h^, xrefs: 00557597
S];&, xrefs: 00557003
[d{, xrefs: 00557BEB
Jtu, xrefs: 00557817
YX4, xrefs: 00557329
ju?^, xrefs: 00556EB2
='Sk, xrefs: 00557B9C
W}wq, xrefs: 0055758B
o"V, xrefs: 0055697E
O{c, xrefs: 005574B5
4'V, xrefs: 00556984
ju?^, xrefs: 00556EA7

Memory Dump Source

Source File: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID: 4'V$='Sk$Jtu$O{c$S];&$W}wq$YX4$[d{$ju?^$ju?^$o"V$h^
API String ID: 0-2751313848
Opcode ID: ee181d5f1afd92231a5845ee0d39cf2d6c73541d60866de45a57e3ba3d596f11
Instruction ID: f01b77b400b3d368f7f513ad93175f237d3090e9bbaa8d3fc78df3df68af797c
Opcode Fuzzy Hash: ee181d5f1afd92231a5845ee0d39cf2d6c73541d60866de45a57e3ba3d596f11
Instruction Fuzzy Hash: A6B219F3A0C2149FE3046E2DEC8567AFBE9EF94720F1A493DEAC4C3744E93558058696

Function 0054C6CF Relevance: 11.6, Strings: 8, Instructions: 1604COMMON

Download Yara Rule

Strings

sX|O, xrefs: 0054CCAE
*w?, xrefs: 0054D674
&ko~, xrefs: 0054D45F
nP?, xrefs: 0054CE43
o, xrefs: 0054C845
_#K, xrefs: 0054CBD5
k&>M, xrefs: 0054CAF4
s|}, xrefs: 0054D663

Memory Dump Source

Source File: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID: &ko~$*w?$_#K$k&>M$nP?$sX|O$s|}$o
API String ID: 0-1366266567
Opcode ID: 2aee36650726cfe7d021285c605dd89efd20bd67726646adf00efc18427c3346
Instruction ID: 666a52d52406fdf2f5b1b6ac5121191e3745ff97286128cd280ce7acde32933c
Opcode Fuzzy Hash: 2aee36650726cfe7d021285c605dd89efd20bd67726646adf00efc18427c3346
Instruction Fuzzy Hash: 52B2F5F3A0C2049FE304AE2DEC8567ABBE5EF94720F1A493DE6C5C3744EA3558058697

Function 003A098B Relevance: 10.8, Strings: 8, Instructions: 836COMMON

Download Yara Rule

Strings

{, xrefs: 003A1502
gce/, xrefs: 003A1073
cah`, xrefs: 003A107E
9.5^, xrefs: 003A0F9F
%*+(, xrefs: 003A0A77, 003A0A86
qrqp, xrefs: 003A1089
,#15, xrefs: 003A0F94
&> &, xrefs: 003A0F89

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID: %*+($&> &$,#15$9.5^$cah`$gce/$qrqp${
API String ID: 0-4102007303
Opcode ID: e6ba2d38950997a69e465b6c6577d8e1ef1dbf29b49e241457bad06f94a27583
Instruction ID: 185e29d7b15a2843370c400f16aa82403d8d2ddaa27477e7373822ef23e525ad
Opcode Fuzzy Hash: e6ba2d38950997a69e465b6c6577d8e1ef1dbf29b49e241457bad06f94a27583
Instruction Fuzzy Hash: 8562B8B56083818FD335DF14D891BABBBE1FF96314F09492DE89A8B681E3359940CB53

Function 00381000 Relevance: 10.5, Strings: 7, Instructions: 1785COMMON

Download Yara Rule

Strings

@, xrefs: 00382C40
gfff, xrefs: 003822E1
-, xrefs: 003821ED
0123456789ABCDEFXP, xrefs: 0038157D, 003815EB
0123456789abcdefxp, xrefs: 00381587, 003815F8
gfff, xrefs: 00382297
gfff, xrefs: 00382226

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID: -$0123456789ABCDEFXP$0123456789abcdefxp$@$gfff$gfff$gfff
API String ID: 0-2517803157
Opcode ID: 6419c63e5918f489b567d21a2a8511ce5022a2fe9cc5f6d79085e152332f650d
Instruction ID: 666da801bfba1bd152ebb13b10de8bcb133fbeca4a607ba7ccce74ff61aa0b61
Opcode Fuzzy Hash: 6419c63e5918f489b567d21a2a8511ce5022a2fe9cc5f6d79085e152332f650d
Instruction Fuzzy Hash: 28D225716083418FC71ADE28C89436BBBE2AFC5314F198AADE499CB391D774DD45CB82

Function 00553244 Relevance: 9.2, Strings: 6, Instructions: 1673COMMON

Download Yara Rule

Strings

tysw, xrefs: 005542AE
V[,O, xrefs: 005533A5
fn}], xrefs: 00554335
:A{n, xrefs: 00553A28
G[/u, xrefs: 00553C9A
qm^, xrefs: 005535F5

Memory Dump Source

Source File: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID: :A{n$G[/u$V[,O$fn}]$qm^$tysw
API String ID: 0-2896847891
Opcode ID: 4fbe763f0187ecb306e7ee7434e5f9609fc20cb1006ffd0dc8a49f7c42fc54f0
Instruction ID: 8ec8f6dc0551d92d033602bf90594d2408aa6f4c34d442715691bbafc26c5370
Opcode Fuzzy Hash: 4fbe763f0187ecb306e7ee7434e5f9609fc20cb1006ffd0dc8a49f7c42fc54f0
Instruction Fuzzy Hash: 56B229F3A0C2049FE304AE2DEC8567ABBE5EFD4320F16863DE6C587744EA3558058786

Function 00559D48 Relevance: 9.1, Strings: 6, Instructions: 1611COMMON

Download Yara Rule

Strings

uN8, xrefs: 0055AA5A
w{, xrefs: 0055A571
]+y, xrefs: 0055A937
e,` , xrefs: 0055A873
V=~|, xrefs: 00559F68
}|h~, xrefs: 0055ADA5

Memory Dump Source

Source File: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID: V=~|$]+y$e,` $uN8$}|h~$w{
API String ID: 0-3903617328
Opcode ID: 00f7b7a9cf121ae23244a8fe0909d56f16ced539ed588092ebd285555f5eb682
Instruction ID: 0d35bb77d55ca2c5f7b159ab7027d82725e2739d4207866d152de0c65e1ff103
Opcode Fuzzy Hash: 00f7b7a9cf121ae23244a8fe0909d56f16ced539ed588092ebd285555f5eb682
Instruction Fuzzy Hash: DAB2D6F390C204AFE3046E29EC8567AFBE9EFD4720F1A893DE6C487744E63558058697

Function 005583DC Relevance: 7.8, Strings: 5, Instructions: 1510COMMON

Download Yara Rule

Strings

*/3, xrefs: 00558CE4
LX{g, xrefs: 005592DC
[g/u, xrefs: 0055948C
'wz', xrefs: 005589C7
ZV^, xrefs: 005585CC

Memory Dump Source

Source File: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID: 'wz'$*/3$LX{g$ZV^$[g/u
API String ID: 0-2666784648
Opcode ID: 5633b622ae6e8f423e2588d9c30c700d560a4b7a62874302da1abf877009670b
Instruction ID: 5b9f9cf1497dabdbef4cd18bf1b3245573babb2e56d2bcda7d8c848592448a45
Opcode Fuzzy Hash: 5633b622ae6e8f423e2588d9c30c700d560a4b7a62874302da1abf877009670b
Instruction Fuzzy Hash: E7A2F5F3A0C2049FE7046E29EC4567ABBE5EF94720F1A493DEAC4C3744EA3598058797

Function 003812F7 Relevance: 7.2, Strings: 5, Instructions: 922COMMON

Download Yara Rule

Strings

0, xrefs: 00381DC1
0, xrefs: 00381E88
@, xrefs: 00383531
i, xrefs: 003828EA
0, xrefs: 0038243E

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID: 0$0$0$@$i
API String ID: 0-3124195287
Opcode ID: f8e6ef6ed1668ec435f7235181f3aa51967e750d79a80500fa6ab40d16086fe7
Instruction ID: 0dfac705bc3178e84a8252690838aea5faee9d24dba4120fa87fbf77d8c027a8
Opcode Fuzzy Hash: f8e6ef6ed1668ec435f7235181f3aa51967e750d79a80500fa6ab40d16086fe7
Instruction Fuzzy Hash: 6562E37160C3818FC71AEE28C49076BBBE5AFD5304F198A9DE8D987391D374D949CB82

Function 0038164F Relevance: 6.7, Strings: 5, Instructions: 472COMMON

Download Yara Rule

Strings

+, xrefs: 00381573
0123456789ABCDEFXP, xrefs: 0038164F
gfff, xrefs: 00381F57
0123456789abcdefxp, xrefs: 00381659
gfff, xrefs: 00381F3C

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID: +$0123456789ABCDEFXP$0123456789abcdefxp$gfff$gfff
API String ID: 0-1123320326
Opcode ID: e9156ea57d8db35f30b3e8c4d569a83d2f5b66ff7348a289a5525acaab770e2a
Instruction ID: 8c90c6ea5e5e2033c1d313d9d384099ac7e286609c99b3356c12b86af8cb4678
Opcode Fuzzy Hash: e9156ea57d8db35f30b3e8c4d569a83d2f5b66ff7348a289a5525acaab770e2a
Instruction Fuzzy Hash: 4CF1C13460C3818FC71ADE29C48436AFBE2AFD9304F198AADE4D987352D774D945CB92

Function 003813A3 Relevance: 6.6, Strings: 5, Instructions: 390COMMON

Download Yara Rule

Strings

0123456789ABCDEFXP, xrefs: 003813A3
gfff, xrefs: 00381F57
-, xrefs: 00381F23
0123456789abcdefxp, xrefs: 003813AD
gfff, xrefs: 00381F3C

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID: -$0123456789ABCDEFXP$0123456789abcdefxp$gfff$gfff
API String ID: 0-3620105454
Opcode ID: 5ed6b1c42c95119edaabffe4128d6cf0f3e8a6daa8a42f9203fa7a343d017f6b
Instruction ID: 93245ece3e43e566e86370624c12ea1c48954d232086683982dce0261887d654
Opcode Fuzzy Hash: 5ed6b1c42c95119edaabffe4128d6cf0f3e8a6daa8a42f9203fa7a343d017f6b
Instruction Fuzzy Hash: 32D1AE3560C7818FC71ADE29C48026AFBE2AFD9304F09CAADE4D987356D734D949CB52

Function 003AFD10 Relevance: 5.7, Strings: 4, Instructions: 667COMMON

Download Yara Rule

Strings

NA_I, xrefs: 003B036D
m1s3, xrefs: 003AFEC3, 003AFECB
:, xrefs: 003B0087
uvw, xrefs: 003AFE95

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID: :$NA_I$m1s3$uvw
API String ID: 0-3973114637
Opcode ID: 842473310df984468345cefcd7e63b9de88d7ba69bef3aab9306b7e57b33ff10
Instruction ID: aa1e1f05053afbbee383fa82e40ba0fc878b0d5b6862adf87a9687ecbe6bb2de
Opcode Fuzzy Hash: 842473310df984468345cefcd7e63b9de88d7ba69bef3aab9306b7e57b33ff10
Instruction Fuzzy Hash: 0A32BAB0509380DFD316DF29E880B6BBBE5AB8A304F144A6DF6D58B292D335D905CF52

Function 00393BE2 Relevance: 5.4, Strings: 4, Instructions: 431COMMON

Download Yara Rule

Strings

;z, xrefs: 00393C87
p, xrefs: 00393C80
ss, xrefs: 00393C79
%*+(, xrefs: 00393EC4

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID: %*+($;z$p$ss
API String ID: 0-2391135358
Opcode ID: 8424f8e8f4cb650b93aafafc70770b97f8d742322b300a3a969dd8ef403dced3
Instruction ID: 9109b85b33ac9be91454aa93e44084a95200428f202f0d7b5f100c1f113f137b
Opcode Fuzzy Hash: 8424f8e8f4cb650b93aafafc70770b97f8d742322b300a3a969dd8ef403dced3
Instruction Fuzzy Hash: D8025DB4810700DFDB61EF25D986B56BFF5FB02700F50495DE89A8B695E330A819CFA2

Function 003A2260 Relevance: 5.4, Strings: 4, Instructions: 383COMMON

Download Yara Rule

Strings

hu, xrefs: 003A232F
lc, xrefs: 003A2507
a|, xrefs: 003A2317
sj, xrefs: 003A2327

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID: a|$hu$lc$sj
API String ID: 0-3748788050
Opcode ID: 8448a6f9a5e3d3544eb90e6a46c170f854b361e9ed1c2c4c3c36b920421b6552
Instruction ID: 5e4bc163f5f43c6c8ffab25ace0026825ef7431e049545d7045946b793d7289c
Opcode Fuzzy Hash: 8448a6f9a5e3d3544eb90e6a46c170f854b361e9ed1c2c4c3c36b920421b6552
Instruction Fuzzy Hash: A5A1AC748083408BC721DF19C891A2BF7F0FF96354F198A0CE8D99B291E339D945CBA6

Function 003AD7AF Relevance: 5.2, Strings: 4, Instructions: 213COMMON

Download Yara Rule

Strings

KV, xrefs: 003AD97D
T>, xrefs: 003AD984
#', xrefs: 003AD9EA
CV, xrefs: 003AD98B

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID: #'$CV$KV$T>
API String ID: 0-95592268
Opcode ID: f88d439ccf359420b8e8fd631bc1cb2927dbcdfdb83ff137bc6820fdb6305551
Instruction ID: 202947795912ffb45d6326eb2d3a4e9d2474775aebad0500303515307baacd26
Opcode Fuzzy Hash: f88d439ccf359420b8e8fd631bc1cb2927dbcdfdb83ff137bc6820fdb6305551
Instruction Fuzzy Hash: B98155B4801B459BDB20DF95D28516FBFB1FF12300F60560CE486ABA55C334AA55CFE2

Function 003AAC91 Relevance: 5.1, Strings: 4, Instructions: 128COMMON

Download Yara Rule

Strings

(g6e, xrefs: 003AACA1
4c2a, xrefs: 003AACA9
lk, xrefs: 003AACBC
,{*y, xrefs: 003AAD07, 003AAD13

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID: (g6e$,{*y$4c2a$lk
API String ID: 0-1327526056
Opcode ID: f4d493bf65a8df1e8b4ef3d41b1781e1e314275a43fd2f98f2b3e5b82f8a268b
Instruction ID: 01bc0173296a9ad20d3b9f2859a6d9d312668fdb7ada33f258b0fc0a47f7bc95
Opcode Fuzzy Hash: f4d493bf65a8df1e8b4ef3d41b1781e1e314275a43fd2f98f2b3e5b82f8a268b
Instruction Fuzzy Hash: 9541B7B5409381CBD7229F20D800BABB7F4FF86305F54995EE5C897220DB35D944CB96

Function 003AC470 Relevance: 4.2, Strings: 3, Instructions: 419COMMON

Download Yara Rule

Strings

%*+(, xrefs: 003AC8C3, 003AC8CB
%*+(, xrefs: 003AC9E4, 003AC9ED
~/i!, xrefs: 003AC537

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID: %*+($%*+($~/i!
API String ID: 0-4033100838
Opcode ID: c281aa42c3ca47af997b81e130542afbd59a452da5e268a8fa925f0806ffa541
Instruction ID: a17cac7130728e4a4d5a7fb6f5dd584565a351314e941914de591e5792899325
Opcode Fuzzy Hash: c281aa42c3ca47af997b81e130542afbd59a452da5e268a8fa925f0806ffa541
Instruction Fuzzy Hash: CDE1A8B5519340EFE3219F64E881B2BBBF9FB86344F48882DE5C98B251D735D814CB92

Function 00554D40 Relevance: 4.1, Strings: 2, Instructions: 1623COMMON

Download Yara Rule

Strings

Qdo, xrefs: 00555DEA
+Knc, xrefs: 00555053

Memory Dump Source

Source File: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID: +Knc$Qdo
API String ID: 0-1045425001
Opcode ID: fe1f029e6037487ae232e435282be9e69aa8e43c75a67d22c0f73f87716a3b4c
Instruction ID: bdc0e0631ea10154350c692f58f69b95b39a7b6c373d29fecdad30314c7c59cf
Opcode Fuzzy Hash: fe1f029e6037487ae232e435282be9e69aa8e43c75a67d22c0f73f87716a3b4c
Instruction Fuzzy Hash: DDB216F3A0C2109FE304AE29EC8567AFBE9EF94720F1A493DE9C4C7740E67558058796

Function 003C4040 Relevance: 3.1, Strings: 2, Instructions: 577COMMON

Download Yara Rule

Strings

f, xrefs: 003C420C
%*+(, xrefs: 003C40A4, 003C40AD

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID: %*+($f
API String ID: 0-2038831151
Opcode ID: d350a3a66a6fb5e8a0ab554b2d92af7028587f803211248aedec6cd4d9b057c5
Instruction ID: 31ac152f0560a72acdd213f64b3c2443e631784a582c8f75854d0f459c2ab62d
Opcode Fuzzy Hash: d350a3a66a6fb5e8a0ab554b2d92af7028587f803211248aedec6cd4d9b057c5
Instruction Fuzzy Hash: FE129B716083408FC716CF18D8A0F2ABBE5BB89314F198A2DF4D5DB291D735ED458B92

Function 003BF620 Relevance: 3.0, Strings: 2, Instructions: 461COMMON

Download Yara Rule

Strings

dg, xrefs: 003BF7F5
hi, xrefs: 003BF6E6

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID: dg$hi
API String ID: 0-2859417413
Opcode ID: b31d499148924414888da7f6289a4fe6965ab625bdf4b865748b9a2a5f6e6f73
Instruction ID: b28bf5b83cbb402a4605019c803a45ee1591728776e2a603a8e02be7af33fb0e
Opcode Fuzzy Hash: b31d499148924414888da7f6289a4fe6965ab625bdf4b865748b9a2a5f6e6f73
Instruction Fuzzy Hash: 17F18371618301EFE306CF24D891B6BBBEAEB86348F149D6DF5858B2A1C734D945CB12

Function 003835B0 Relevance: 2.9, Strings: 2, Instructions: 411COMMON

Download Yara Rule

Strings

NaN, xrefs: 0038360E
Inf, xrefs: 00383607

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID: Inf$NaN
API String ID: 0-3500518849
Opcode ID: c74e80382b58d46c4e26a82ac6b7ba61157b0f3db8e3b02b51aedbada6bc296f
Instruction ID: 21f3b45d49bd6beb4a5231bf7accdc5171fc260bb5caa0436e8ffba5a410d272
Opcode Fuzzy Hash: c74e80382b58d46c4e26a82ac6b7ba61157b0f3db8e3b02b51aedbada6bc296f
Instruction Fuzzy Hash: EDD1F571A083119BC709DF28C88061EB7E5FFC8B50F258A6DF999973A0E775DD048B82

Function 0039FFDF Relevance: 2.7, Strings: 2, Instructions: 185COMMON

Download Yara Rule

Strings

BaBc, xrefs: 003A0197
Ye[g, xrefs: 003A00F6

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID: BaBc$Ye[g
API String ID: 0-286865133
Opcode ID: f2dbe4f157f05c37b2071c9e56ae8620d4ade292a7153c641636c5cf6d810b77
Instruction ID: 80e538adc7c05aea0096c94b4c6f845c7c3a8b759a11cad9f50df143953e4c5a
Opcode Fuzzy Hash: f2dbe4f157f05c37b2071c9e56ae8620d4ade292a7153c641636c5cf6d810b77
Instruction Fuzzy Hash: 1E51B8B16083818BC33ACF14C881BABB7E0FF97320F09491DE49A9B651E3749944CB57

Function 00385160 Relevance: 1.8, Strings: 1, Instructions: 577COMMON

Download Yara Rule

Strings

%1.17g, xrefs: 003854C8

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID: %1.17g
API String ID: 0-1551345525
Opcode ID: 39eb6385e5d58f58833156694fe56049d90a653899f525e2495eac9a3cac320e
Instruction ID: bffe799659cf4722a5ab09fb0515b19310fb8bfde644813f75adeca082828d52
Opcode Fuzzy Hash: 39eb6385e5d58f58833156694fe56049d90a653899f525e2495eac9a3cac320e
Instruction Fuzzy Hash: E022C3B6A08B428BE717AE18D940726BBA2AFE1314F1EC5EDE8594B351E771DC04C742

Function 003B12D0 Relevance: 1.7, Strings: 1, Instructions: 484COMMON

Download Yara Rule

Strings

", xrefs: 003B15D1

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 1e36e4a90a5bcd9904d9a2755a98640d2f51fe7f53356f7c076c40d918f289ea
Instruction ID: d07b3259a8155369d041922ba971633070ec6dfeb3bf0c71940b87d925409e3e
Opcode Fuzzy Hash: 1e36e4a90a5bcd9904d9a2755a98640d2f51fe7f53356f7c076c40d918f289ea
Instruction Fuzzy Hash: FDF16771A083414FC726CF25C4A07ABBBE5AFC1348F59C96DE99A8B782D634DC04C792

Function 003AAE57 Relevance: 1.7, Strings: 1, Instructions: 455COMMON

Download Yara Rule

Strings

%*+(, xrefs: 003AB2D3, 003AB2DB

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 89c8b1015c9794e30945bfddedcfbcd4a80176c562afd37602ab0535f4bcc826
Instruction ID: 6e7388d3c3230eb949f027f5b877dacf9064c101bf86c08714ec7d2db64f7bf0
Opcode Fuzzy Hash: 89c8b1015c9794e30945bfddedcfbcd4a80176c562afd37602ab0535f4bcc826
Instruction Fuzzy Hash: 69E1DA75508306DBC716EF28C88056EF3E6FF9A781F65891CE4C587261E330E959CB82

Function 00396EBF Relevance: 1.7, Strings: 1, Instructions: 447COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00396EF3

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: e8187dbfc47c4f6022f704db1fbb93a8f6da57e0234f63f651efe8afda89692b
Instruction ID: a0d415ea8a30ce2da4926b829796466153e252946e42348ab16a9f9a2474c38f
Opcode Fuzzy Hash: e8187dbfc47c4f6022f704db1fbb93a8f6da57e0234f63f651efe8afda89692b
Instruction Fuzzy Hash: E4F190B5A11B01CFCB26DF24D881A26B3F6FF48314B148A6DE49787A91EB34F815CB51

Function 003A7E60 Relevance: 1.7, Strings: 1, Instructions: 425COMMON

Download Yara Rule

Strings

%*+(, xrefs: 003A8263, 003A826B

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 9edfc30fdf8f3a3e396e2fde79159f80ee3a63972445e0e87ae49cfa55c0ff5f
Instruction ID: 94de7de957c9ef8da726c440221e1b8916754d63d982a65bf090397557f93319
Opcode Fuzzy Hash: 9edfc30fdf8f3a3e396e2fde79159f80ee3a63972445e0e87ae49cfa55c0ff5f
Instruction Fuzzy Hash: 0CC1AC71908300ABD712EB14CC82A2BB7F5EF96754F19881CF8C59B251E735ED15CBA2

Function 003A8D62 Relevance: 1.7, Strings: 1, Instructions: 410COMMON

Download Yara Rule

Strings

%*+(, xrefs: 003A9233, 003A923B

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: b5b4a9ca3ef3a02cd977e91fef28c58acf936942f74118f27eb2c2b190ec516f
Instruction ID: 4466d8a23950d8896549647306d2f593882cf267a9ea369c1a6ce6f2042ede9d
Opcode Fuzzy Hash: b5b4a9ca3ef3a02cd977e91fef28c58acf936942f74118f27eb2c2b190ec516f
Instruction Fuzzy Hash: 20D1E070619302DFD70ADF64EC90B2AB7EAFF8A300F59486EE48697291D730E950CB51

Function 00394487 Relevance: 1.6, Strings: 1, Instructions: 389COMMON

Download Yara Rule

Strings

BI9, xrefs: 0039485E

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID: BI9
API String ID: 0-4074896632
Opcode ID: aa8765c50e803d5406f04ab9996a2e5897c3bd2649b2b537dc87d40a401000e7
Instruction ID: 97ee20d02f5f35c20e2efca993f492533f5d8f82c750f0df2ff07db91de17383
Opcode Fuzzy Hash: aa8765c50e803d5406f04ab9996a2e5897c3bd2649b2b537dc87d40a401000e7
Instruction Fuzzy Hash: B5E112B5511B008FD722DF28D992B97B7E5FF06708F04885CE4AACBB52E735B8148B54

Function 003C7FC0 Relevance: 1.6, Strings: 1, Instructions: 387COMMON

Download Yara Rule

Strings

P, xrefs: 003C8167

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID: P
API String ID: 0-3110715001
Opcode ID: eb87e33ea806985a565c465fc68679b8700ee1bf68b5735190e6d63d0e91f000
Instruction ID: c4d4203363520d2411d61ddaff03d734d2d6ed8bfcdb97556f3e8aa1e9793cee
Opcode Fuzzy Hash: eb87e33ea806985a565c465fc68679b8700ee1bf68b5735190e6d63d0e91f000
Instruction Fuzzy Hash: B1D1C6729082654FC726CF189890B1EB7E1EB85718F168A3CE9A5EB390CB71DD46C7C1

Function 003C6CBF Relevance: 1.6, Strings: 1, Instructions: 384COMMON

Download Yara Rule

Strings

"p<, xrefs: 003C7015

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID: "p<
API String ID: 0-3302510317
Opcode ID: f99311ea431b1a7d082091b6fbe212d5b91956192ddeb831826c3e2b92521772
Instruction ID: 5182df2a6722379c5ad2fbfae118899b049d7435e30f1df24656c91b47bfe075
Opcode Fuzzy Hash: f99311ea431b1a7d082091b6fbe212d5b91956192ddeb831826c3e2b92521772
Instruction Fuzzy Hash: 6BD1E236629355CFC726CF38E88062AB7E5BB89314F094A6ED495C73A1D334DA44CB91

Function 003ACCD0 Relevance: 1.6, Strings: 1, Instructions: 357COMMON

Download Yara Rule

Strings

%*+(, xrefs: 003ACDC3, 003ACDCB

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID: InitializeThunk
String ID: %*+(
API String ID: 2994545307-3233224373
Opcode ID: a93c89075474733886104b5c6cc46e593c139467a0ef6d7a653b28aace253ced
Instruction ID: 049fed52861c091ca1c2439df18ca6ce38235ef3f25e5f1229719fd19073504e
Opcode Fuzzy Hash: a93c89075474733886104b5c6cc46e593c139467a0ef6d7a653b28aace253ced
Instruction Fuzzy Hash: EFB1ED706293018FD716EF18D880B2BBBE6EF96341F14592CE5C58B351E335E855CBA2

Function 003BFC20 Relevance: 1.5, Strings: 1, Instructions: 265COMMON

Download Yara Rule

Strings

%*+(, xrefs: 003BFCA4, 003BFCAD

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 58a1f42bf017533da4d0b8ff5e2399b09eb33825af7a44acd0306fea1a00c960
Instruction ID: 411708fad96f6699cb41960b4f892e42d5a5d2e1e4df61f9117fe709172b4839
Opcode Fuzzy Hash: 58a1f42bf017533da4d0b8ff5e2399b09eb33825af7a44acd0306fea1a00c960
Instruction Fuzzy Hash: C281BC70619300AFD712DF58EC84B6AB7E9FB99709F14882DF68487251D731E914CB62

Function 0039D457 Relevance: 1.5, Strings: 1, Instructions: 248COMMON

Download Yara Rule

Strings

%*+(, xrefs: 0039D663, 0039D66B

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 6fdafa4df6db5ea438a5b2de220f72d8d8a91eb347894b10dc55e9acdb2d7feb
Instruction ID: 18c296bd5abddd109bdcaecc94824184c949267434850a0b4ea20f11fb939c6e
Opcode Fuzzy Hash: 6fdafa4df6db5ea438a5b2de220f72d8d8a91eb347894b10dc55e9acdb2d7feb
Instruction Fuzzy Hash: BB610275909301DBDB16EF58EC82B2AB3B4FF95354F49082DF9858B251E335E910C792

Function 003C4A40 Relevance: 1.5, Strings: 1, Instructions: 220COMMON

Download Yara Rule

Strings

%*+(, xrefs: 003C4C33, 003C4C3B

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: d54e43f8f46161b9714b5fa2e86d4c026a6cb410739cbb80a99096220b40d86c
Instruction ID: afeb9ebfcb619f7fa5df450d8e3565a64d21dba2000bce00d6666e5386fe1808
Opcode Fuzzy Hash: d54e43f8f46161b9714b5fa2e86d4c026a6cb410739cbb80a99096220b40d86c
Instruction Fuzzy Hash: 7861F075609301ABD712DF25D8A0F2AB7EAEBC4314F29891CE9C5CB2A1D731EC40CB52

Function 0038E1A0 Relevance: 1.4, Strings: 1, Instructions: 175COMMON

Download Yara Rule

Strings

000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F8081, xrefs: 0038E333

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID: 000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F8081
API String ID: 0-2471034898
Opcode ID: 01a6ac0ed52d7f2ef91a213efdb7605658fc05157bd6844679b5762aadd21d49
Instruction ID: 25ae0a3cf69828a80ea2bf13a1abc0e11ebfd34d165a2012abdf04cb0d7caaf9
Opcode Fuzzy Hash: 01a6ac0ed52d7f2ef91a213efdb7605658fc05157bd6844679b5762aadd21d49
Instruction Fuzzy Hash: B7512837B197A04BD326A93C5C552696ACB0BD2334F2E87A9E9F5CB3E1D5554C004350

Function 003C3920 Relevance: 1.4, Strings: 1, Instructions: 172COMMON

Download Yara Rule

Strings

%*+(, xrefs: 003C39E3, 003C39EB

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 0765a0a73a96395f4388261302c6c8ed959f1bceea4838db76826bd6430b6895
Instruction ID: 958830f0234ca3535aa4f60d65a4f1105aaf9d64c384074fe76de6f4538fa205
Opcode Fuzzy Hash: 0765a0a73a96395f4388261302c6c8ed959f1bceea4838db76826bd6430b6895
Instruction Fuzzy Hash: 6F518E386092409BCB26DF19D880F2ABBE9EF89744F15C81CE4C6C7251D771EE20CB62

Function 00408DCA Relevance: 1.4, Strings: 1, Instructions: 152COMMON

Download Yara Rule

Strings

AEw, xrefs: 00408EB9

Memory Dump Source

Source File: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID: AEw
API String ID: 0-985756538
Opcode ID: 835da1aa7a7b614c95018808b2172140063e29d20ee5c16c2f9ab9b32dca329a
Instruction ID: 6591fb46c19da4e7fb5a74ba928f8541fae3cedfbf9eba58d8d2998dbc9552e9
Opcode Fuzzy Hash: 835da1aa7a7b614c95018808b2172140063e29d20ee5c16c2f9ab9b32dca329a
Instruction Fuzzy Hash: EB4125B3E142144FE3505DA9DC95366B6D6DB94320F2A463EEA84D7384E87A9C0547C2

Function 00391BEE Relevance: 1.4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

Strings

L3, xrefs: 00391C3E

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID: L3
API String ID: 0-2730849248
Opcode ID: 0b7e6c9868416d7b808fee5b14353f68206e11d4aa63b0fca9e53eda8b0965f4
Instruction ID: 4fc2674f55ff642dbb4c805ac437730972e016ae85a2e8043f088917a8a9d041
Opcode Fuzzy Hash: 0b7e6c9868416d7b808fee5b14353f68206e11d4aa63b0fca9e53eda8b0965f4
Instruction Fuzzy Hash: 5C4173B80083819BCB169F28D894A2FBBF4FF86314F048A1CF5C5AB290D736C915CB56

Function 003BFF70 Relevance: 1.4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

Strings

%*+(, xrefs: 003C0033, 003C003B

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: a19c0e21584c155bb90ba2d353bbc85b0b2f5c55b56f521ed58e1ed4f5454364
Instruction ID: 9434e3d534b804f9809ef39cf76e4372db3aedb944e659a83867ba405a25a462
Opcode Fuzzy Hash: a19c0e21584c155bb90ba2d353bbc85b0b2f5c55b56f521ed58e1ed4f5454364
Instruction Fuzzy Hash: 0E3105B5A04364EBD616EA14DC81F2BB7ECEB81748F16482CF884C7252E631DC14C763

Function 003AE40C Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

72?1, xrefs: 003AE6A2

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID: 72?1
API String ID: 0-1649870076
Opcode ID: dfe50bbafe49dc5f9cf2dcd6f265ea34eea226fa6c4ebfeff11317809458f149
Instruction ID: 93a55688d32c3e8dbe6cda704e8cea9e7bbcd4106b7a64873f12e59a8cda12f3
Opcode Fuzzy Hash: dfe50bbafe49dc5f9cf2dcd6f265ea34eea226fa6c4ebfeff11317809458f149
Instruction Fuzzy Hash: BC31E6B5901304DFC722DF94E8905AFF7B9FB06304F540859E446AB301D335AA04CBA1

Function 00396F91 Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

%*+(, xrefs: 0039703B

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 340c9f02ed450df0547f7817c0bb880fb1f1db503102ac34709dd0f89e80387e
Instruction ID: aeb3c89686e4c2a098f5d159a99bf34bd05eaf22305f95232466e0d030a9cb3a
Opcode Fuzzy Hash: 340c9f02ed450df0547f7817c0bb880fb1f1db503102ac34709dd0f89e80387e
Instruction Fuzzy Hash: 8A414775215B04DBDB368F61D994F26B7F6FB09705F24891DE5869BBA1E331F8008B10

Function 003AE66A Relevance: 1.4, Strings: 1, Instructions: 100COMMON

Download Yara Rule

Strings

72?1, xrefs: 003AE6A2

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID: 72?1
API String ID: 0-1649870076
Opcode ID: 3b35eea5471587755f0f2a0de95c246e0d4821dd6efe7f42c128bfe01b523898
Instruction ID: 6d8846838ccadeabafc4741b7e8b01da8c8d973f4eaa8cabd6261bef2fc7f6db
Opcode Fuzzy Hash: 3b35eea5471587755f0f2a0de95c246e0d4821dd6efe7f42c128bfe01b523898
Instruction Fuzzy Hash: 8D21D1B1901304DFC722DF94E8A096FBBB9FB0A704F54085DE446AB341C335AE04CBA1

Function 003C9CE0 Relevance: 1.3, Strings: 1, Instructions: 87COMMON

Download Yara Rule

Strings

@, xrefs: 003C9D30

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: ba50cbfcf769981a5e820568e80a1f278956b062aa186c67f870d089608e9e20
Instruction ID: 0f711867fbef4923d67864bbed21bba2f3c2f92808fb7821fd88c2c72d022617
Opcode Fuzzy Hash: ba50cbfcf769981a5e820568e80a1f278956b062aa186c67f870d089608e9e20
Instruction Fuzzy Hash: 973198705093408BD311DF14D888B2AFBF9EF8A314F25892DE1C6A7251D335DD04CBA6

Function 00394E2A Relevance: 1.0, Instructions: 957COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 230f3bcf12d6e5f0b6cdfd07fa2fd735c3ccca0fa8d1b90438529e7bd574b8dd
Instruction ID: 56868152afc85482ab3e9b844db998d54e9a44f5e108adafef0ceb835e05b509
Opcode Fuzzy Hash: 230f3bcf12d6e5f0b6cdfd07fa2fd735c3ccca0fa8d1b90438529e7bd574b8dd
Instruction Fuzzy Hash: 336259B4510B008FDB26DF24D990B27B7F6AF4A700F54896CD49B8BA52E734F848CB91

Function 0038BEB0 Relevance: .9, Instructions: 895COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30cb9a533554be97e06675d3460cdff0be9d55b2c6c1132c24f0b6137cc6b4a7
Instruction ID: e587af6e25ea4d1933365b24023fb5365b34e1ea0846daee2b8ad21d17fe8857
Opcode Fuzzy Hash: 30cb9a533554be97e06675d3460cdff0be9d55b2c6c1132c24f0b6137cc6b4a7
Instruction Fuzzy Hash: 18524B315287118BC726EF18E4402BAF3E1FFC5319F299A7DD9C697280E734A851CB96

Function 003C8652 Relevance: .7, Instructions: 710COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fd5f33717129b4e576614426fb82a559a47739180bc645f7b8eb83dba3a6d4b
Instruction ID: 5c769b2e0f1326e829c9dd9cc8894882643b05311334686d01bed672761ccec2
Opcode Fuzzy Hash: 6fd5f33717129b4e576614426fb82a559a47739180bc645f7b8eb83dba3a6d4b
Instruction Fuzzy Hash: 0322BA3560A341CFC706DF68E890A2ABBE5FB8A315F0A886EE5C9C7351D735D950CB42

Function 003C86F0 Relevance: .7, Instructions: 681COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94d6d50f624057f96c3b380095f88617d5c196d98435d737872c5e644d53cef3
Instruction ID: 1553767d926d46b101f7ccfe4abb6ae7517fc2c6a8d640c6091b6acbb251b983
Opcode Fuzzy Hash: 94d6d50f624057f96c3b380095f88617d5c196d98435d737872c5e644d53cef3
Instruction Fuzzy Hash: 1622A935609340DFC706DF68E890A1ABBE9FB8A305F0A896EE4C9C7351D735E950CB42

Function 0038B3A0 Relevance: .7, Instructions: 670COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3925db2b5b39808daaa87f0abe2e235b6dd05b574553a1be740c5cd54d590dd1
Instruction ID: 81b02e5f756971f5c7125382528a56c9da6a8c4acaf58c57372b277623d7c543
Opcode Fuzzy Hash: 3925db2b5b39808daaa87f0abe2e235b6dd05b574553a1be740c5cd54d590dd1
Instruction Fuzzy Hash: 3752E670908B858FE736EB24C0943A7FBE2EF91314F154CADD5E606B82C779A889C751

Function 003871F0 Relevance: .7, Instructions: 657COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ac7953754a1530ab4031e3ca13f016b153f128c0b7109bd0466cd6b4a35b0c8
Instruction ID: 944563d3c6bf41460dfb083b086589f4f0b92db62398c5f7117e4aaeec776efa
Opcode Fuzzy Hash: 6ac7953754a1530ab4031e3ca13f016b153f128c0b7109bd0466cd6b4a35b0c8
Instruction Fuzzy Hash: 8452D23150C3458FCB16DF28C0906AABBE2FF89314F298AADF89957351D774E949CB81

Function 00388FD0 Relevance: .6, Instructions: 620COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35ecca9eb30963cffbe23065e62908afb53bc29a7d90608ed2919ee9bfa2d35b
Instruction ID: 32fd5d86660c4830ab11c052765852c974103a3413ba1e6888d3297f5193fcb9
Opcode Fuzzy Hash: 35ecca9eb30963cffbe23065e62908afb53bc29a7d90608ed2919ee9bfa2d35b
Instruction Fuzzy Hash: AC428579208341DFD709CF28D850B6ABBE5BF89315F09886DE4858B3A1D339E985CF42

Function 00387BF0 Relevance: .6, Instructions: 592COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e01d5e5496ac332abf9e42433b22d1b9de798f1ecf7c6c6b13496dff728f0486
Instruction ID: 1883b1f92524df420c13746740c9064b4d3110d56e507ea9d518af229c8bc7bd
Opcode Fuzzy Hash: e01d5e5496ac332abf9e42433b22d1b9de798f1ecf7c6c6b13496dff728f0486
Instruction Fuzzy Hash: 5E321270514B118FC36ADF29C590526BBF2BF85710BA04A6ED6A787F90DB36F845CB10

Function 003C89A0 Relevance: .5, Instructions: 545COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49569f1062f5ca90ea5be20c519017a0a358e0da67d256561733ee628cd73228
Instruction ID: 29a6885612b7e1e8806dea4d497e94ba6eed3b0f8256c3e7121cf9e318692e8a
Opcode Fuzzy Hash: 49569f1062f5ca90ea5be20c519017a0a358e0da67d256561733ee628cd73228
Instruction Fuzzy Hash: 61029935609241DFC706DF68E890A1AFBE5FF8A305F0A896EE4C5C7261C736D914CB92

Function 003C8A80 Relevance: .5, Instructions: 524COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4579601b999ae75fa38c5005043cfc18a553d50250ffc9419a93f8982842ca33
Instruction ID: 30ae1af240bbd351eb2ec3d9becb7862a5bb4da0342d380dcbd383e6fdc4f97f
Opcode Fuzzy Hash: 4579601b999ae75fa38c5005043cfc18a553d50250ffc9419a93f8982842ca33
Instruction Fuzzy Hash: 76F17935609340DFC706DF68E884A1AFBE5AF8A305F0A8D6EE4C5C7251D736D914CB92

Function 003C8C02 Relevance: .5, Instructions: 487COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71da9c3472f7f6b60815e159bf89431d5f6f5a5ecaeee11e938ee42adf8cdd91
Instruction ID: 0aa2f5b8730d72a612e22f5b5c2bd821ca7f17100babdfcf8467aa0e3f9edd69
Opcode Fuzzy Hash: 71da9c3472f7f6b60815e159bf89431d5f6f5a5ecaeee11e938ee42adf8cdd91
Instruction Fuzzy Hash: DDE1AD35609240CFC706DF28E890A2AF7E5BB8A315F0A8D6EE5D9C7351D736D910CB92

Function 0038A300 Relevance: .5, Instructions: 459COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dbf8a9190905fd82ba4d34b3568b61c3c587483ba5650872ac470c2db95d517
Instruction ID: 360c8b0543b4ff077d5fcedf88da63ea706d1928ad815eb2528ba68ef6fdcacf
Opcode Fuzzy Hash: 8dbf8a9190905fd82ba4d34b3568b61c3c587483ba5650872ac470c2db95d517
Instruction Fuzzy Hash: 03F1CC766087418FD725DF29C88166BFBE2AFD8300F08886DE4C587751E639E949CB62

Function 003C8E70 Relevance: .4, Instructions: 420COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdccec5079025dbc34bb8326a5b2eaeedb2ea44975b9c75ee08c6435ef7e4722
Instruction ID: 2a1b2303c001bbbfc1af10bda0263f780282afa7d1a8ffeffccf7470a6d5690f
Opcode Fuzzy Hash: fdccec5079025dbc34bb8326a5b2eaeedb2ea44975b9c75ee08c6435ef7e4722
Instruction Fuzzy Hash: 54D16C3460D240DFD706DF28E894A2AFBE5AB8A305F098D6EE4C5C7251D736D914CB52

Function 003C7AB0 Relevance: .4, Instructions: 354COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05710da352bbedde31f70fc12e93cf64fff1ec4f56493e4fe57afe22705cbf78
Instruction ID: 8ea0b244ed3304fb057efe2b4efa411d63ec3d405e80d601cbf1f5e962a3a2ee
Opcode Fuzzy Hash: 05710da352bbedde31f70fc12e93cf64fff1ec4f56493e4fe57afe22705cbf78
Instruction Fuzzy Hash: D4B11672A0C3504BE316DE28CC45B6BB7E9ABC5314F09496DED99DB381E635EC048B92

Function 0038AF10 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c6117061885288c1b39a5b943f8482e52345fd8b1a48c2f17ef7dcb0cf10c7c
Instruction ID: 3358ba608ee7c641b31db0a0bbf75dce48fa5f9d41346f032bcec488e56cd051
Opcode Fuzzy Hash: 9c6117061885288c1b39a5b943f8482e52345fd8b1a48c2f17ef7dcb0cf10c7c
Instruction Fuzzy Hash: 9FC19DB2A187418FC371DF28DC96BABB7E1BF85318F08492DD1D9C6242E778A155CB06

Function 00396536 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5c4fa93c0387518c31644a1c7e9ba1942be49cde1fa5383a90636b151016154
Instruction ID: 2870a83c28c2787038cb1837cda4a64b51e7eb65ab1389729c285a86b42315c8
Opcode Fuzzy Hash: f5c4fa93c0387518c31644a1c7e9ba1942be49cde1fa5383a90636b151016154
Instruction Fuzzy Hash: EFB11FB4611B408FD722DF24D981B27BBF2AF46704F14885DE8AA8BB52E375F805CB54

Function 003C7710 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 6096be3615f19f6cdbd0bc8f99ecabfaecec88a59c7919910390befb0bdc4329
Instruction ID: d5a8ab8442fb474220bb067c54c299f27e4e35050419799ae8142838a481ba70
Opcode Fuzzy Hash: 6096be3615f19f6cdbd0bc8f99ecabfaecec88a59c7919910390befb0bdc4329
Instruction Fuzzy Hash: E2917A75A09301ABE722DB14D881FABBBE5EB85354F54881CF985D7351E730ED40CB92

Function 003CA0D0 Relevance: .3, Instructions: 282COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 362898964fd9bfe392cc5b5b9d484e7af7272af81a0710d4c3b26323aa7197a7
Instruction ID: 40ca68c1320459935914918254ffbc05f1384506ed1b4a47fe3b26ad7b7bb16f
Opcode Fuzzy Hash: 362898964fd9bfe392cc5b5b9d484e7af7272af81a0710d4c3b26323aa7197a7
Instruction Fuzzy Hash: BD81AE34209B458FD726DF28D890F2AB7E5EF49748F56892CE586CB251E731EC10CB92

Function 003B64F0 Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29592002a0b37e0d091ab56457831206b983cad09fec350d2b37e43fef01dcb9
Instruction ID: 9bca20d335c1789eec6a2b1b795a10dbff932238f0ac35113fb5f8716782c6cb
Opcode Fuzzy Hash: 29592002a0b37e0d091ab56457831206b983cad09fec350d2b37e43fef01dcb9
Instruction Fuzzy Hash: A371C833B29A904BC316997C5C433D5AA475BD7338F3E8379EAB4CBBE6D52948064350

Function 003A28E9 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70404b60f67cf9beb73becc86c36e982ce6cf8d6f9aac2a4b70713a2b7226757
Instruction ID: 549f612aa7f89769785cd53850647940ce93dcb374121953ca28d25e5fa48587
Opcode Fuzzy Hash: 70404b60f67cf9beb73becc86c36e982ce6cf8d6f9aac2a4b70713a2b7226757
Instruction Fuzzy Hash: 9D618A744183408BD312AF18E841A2BBBF4FF92750F14495DF4C58B262E37AD910CB67

Function 003A7C00 Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b2a5438344dd38b45aa58b5445a7a9350251734bc69f421e29be36fe9d8a2fa
Instruction ID: 36db58f0f2415582d1390d60c1694f77372efb4c683dcf8b7d4d9681c8713521
Opcode Fuzzy Hash: 5b2a5438344dd38b45aa58b5445a7a9350251734bc69f421e29be36fe9d8a2fa
Instruction Fuzzy Hash: 2751CDB1618304ABDB22AB24CCD2BB733B8EF86364F154558F9868B291F375DC05C762

Function 003B1860 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d108e008403b3c92b59985e25fae4eb0cb21936506a5ffd7efe5999b9cc5533
Instruction ID: 69399f1e912e7b2326457727e06fc3e2d60998843c37babc67674d241da12a42
Opcode Fuzzy Hash: 6d108e008403b3c92b59985e25fae4eb0cb21936506a5ffd7efe5999b9cc5533
Instruction Fuzzy Hash: 1F611131608341ABD716CF28C5A03AFBBE6ABC5358FA5C82DE2898BB51D370ED419741

Function 003B82D0 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3b2f62a438b37889794f4c61e9d2a9434e11791592e79e383489a35be7e7e85
Instruction ID: a0fea8986ffb1957ff0e20745922552835bdea8cc0a92f8b1e4bb05fa37aad83
Opcode Fuzzy Hash: e3b2f62a438b37889794f4c61e9d2a9434e11791592e79e383489a35be7e7e85
Instruction Fuzzy Hash: 72614937B1AA914BC316463D5C553E66A8F1BD2338F3EC366DAB98BBE4C9694801C341

Function 003942FC Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 543512a2a5c9f4a9cdbea6bab2ebbba5d270d2c15a7d80f792817834d255ea84
Instruction ID: 3758a663b060d6a13c73a3111f8d09edbf300337dea2837dfc55289480870911
Opcode Fuzzy Hash: 543512a2a5c9f4a9cdbea6bab2ebbba5d270d2c15a7d80f792817834d255ea84
Instruction Fuzzy Hash: 3681DFB4810B00AFD361EF39D947B57BEF4AB06701F404A1DE4EA96695E7306419CBE3

Function 003BE8A0 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53adb1b22930f8a695f789fdc3f4b943ccd6ac5fb5c634955e3c1cdf4e3fec6a
Instruction ID: d3bd040e06f8a63c0c2cf9c54950f5dfda347d8df8686d4bb0957e2c01d4a76d
Opcode Fuzzy Hash: 53adb1b22930f8a695f789fdc3f4b943ccd6ac5fb5c634955e3c1cdf4e3fec6a
Instruction Fuzzy Hash: E6518DB16083448FE314DF29D49439BBBE1BBC5318F044E2DE5E987351E379DA088B82

Function 003C7520 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f9fd7db29fe065ab3042449c737130ac876941a6855dbd0598f6779379a9e37
Instruction ID: 421b161254aadcf1caebf9f10b39eafe38b68d4cb328da43b880e63fc1176a45
Opcode Fuzzy Hash: 6f9fd7db29fe065ab3042449c737130ac876941a6855dbd0598f6779379a9e37
Instruction Fuzzy Hash: 5C51D43160D210ABC7169E18DC90F3EB7E6EB85754F298A2CE9E5D7391D631EC108BA1

Function 0043B25F Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 972118c3951aa0e21d5ae2a3c401c74226ad07fa6de7b171e0a7ec129c462398
Instruction ID: d4237bf8fbe9f3a9b9aa7dbfbe6e80934036178b06c86cd5deb9108bc399c38c
Opcode Fuzzy Hash: 972118c3951aa0e21d5ae2a3c401c74226ad07fa6de7b171e0a7ec129c462398
Instruction Fuzzy Hash: 87415AF3B152145BF340A929EC547BBB787CBD0221F2FC639DA94C7784ED7998064291

Function 00385A50 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95d640f3658bb25db7e2d4ee613a7f9566efe952883d54bfbee8974fc2ffc4be
Instruction ID: 5b3971e560fd4329bfeeada91008ca6259229f25fde6fac10468bac5e467e93c
Opcode Fuzzy Hash: 95d640f3658bb25db7e2d4ee613a7f9566efe952883d54bfbee8974fc2ffc4be
Instruction Fuzzy Hash: 8F51F4B5A047049FC716EF18D880926B7A5FF95324F1646ACF8999B352D730EC42CB92

Function 003AEC48 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c746ff2645103f25c73afcbea636479e53a37f562957b108096798b42dd8ecd2
Instruction ID: 754be2ab1faf0be566ce2a22932af21909db1a324fb3079ca827c9f9fa914991
Opcode Fuzzy Hash: c746ff2645103f25c73afcbea636479e53a37f562957b108096798b42dd8ecd2
Instruction Fuzzy Hash: DB41AE78900325DFDF229F94DC91BADB7B0FF0A310F144549E945AB3A0EB38A950CBA1

Function 004B40A9 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e11198d1aee30e5b13a552210cb815eea25d4fec5421915b64e6ad846bd8c6eb
Instruction ID: ea6012c3e502e6f9a9a2de740bda6e76836b08be84dc95c78d5aee930f0c4feb
Opcode Fuzzy Hash: e11198d1aee30e5b13a552210cb815eea25d4fec5421915b64e6ad846bd8c6eb
Instruction Fuzzy Hash: F54136B36086104FE309BE29DC857BEB7E6EFC4320F0A893DD6C187648EA74040187C6

Function 004E43FD Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58229e9be68f6d61fd98fa3efb048e5bd86eceec059199977c43ae13769a18c0
Instruction ID: 175c1ca1153b022f156777601a6718f913f869c8a77b648bfc237341b2276442
Opcode Fuzzy Hash: 58229e9be68f6d61fd98fa3efb048e5bd86eceec059199977c43ae13769a18c0
Instruction Fuzzy Hash: B2412BB32083089FE300AE6EEC8477AF7E9EBD8710F55453DEA84C3744EA3598059656

Function 003C9B60 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94aa342250c5fe5c23ff3643d777d3f26e5868c4577a14a9bf59908520610ae0
Instruction ID: 3fd3bbaa9c80eb0911d4076a55b6137c046ae9e1c7ea9357c5605f3f2c251c29
Opcode Fuzzy Hash: 94aa342250c5fe5c23ff3643d777d3f26e5868c4577a14a9bf59908520610ae0
Instruction Fuzzy Hash: 8B41AF34208300ABD712DB14D994F2AB7EAEB85714F26C82EF589DB251D331EC00CBA2

Function 0068D17C Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a41a385d544d7845589f3487ae193f5cfd74850a38e53ca975dc5e514d80113
Instruction ID: 74d8751165ed79f8f585dfc7149a2a435935d3cbb2c05d4b6bb4f46584f84578
Opcode Fuzzy Hash: 6a41a385d544d7845589f3487ae193f5cfd74850a38e53ca975dc5e514d80113
Instruction Fuzzy Hash: F941B0F250C6049BE719BF19EC817BEBBE5EF44310F06892DEAC587740EA3954408B97

Function 00392030 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90e0a29896b9ad477a037e4979a1f43d1848b6620cc19692f236f21fa25828ff
Instruction ID: 42fd737f121c53a633c6e4a657796d7aa8d70ab1a87eff13eadbb8c854ef4df7
Opcode Fuzzy Hash: 90e0a29896b9ad477a037e4979a1f43d1848b6620cc19692f236f21fa25828ff
Instruction Fuzzy Hash: E5412832A187215FD75DCE2984A463ABBE2AFC5300F09C22EF4DA873D0DB748945D781

Function 00391E93 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea0ed078824290a989e5d0e301d6c7bbb8f42db9864022e3c50dea36d531f0de
Instruction ID: 6eebcd8ae0793f8f522186741d69112ac9fa266a8c7c26874acaaefdbb2c621a
Opcode Fuzzy Hash: ea0ed078824290a989e5d0e301d6c7bbb8f42db9864022e3c50dea36d531f0de
Instruction Fuzzy Hash: 7741EE74508380ABD722AB58C884B2EFBF5FB86744F14491DF6C5A7292C376E8148F66

Function 003C8D8A Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3832ce639f11802d9071d649c1417ccdf91a1e6e979374ce8ada61bec406510
Instruction ID: c2dc65b89fe755f9bed1d86084a1e2fef6e1ede1a9f19796302ae86ed6982db3
Opcode Fuzzy Hash: d3832ce639f11802d9071d649c1417ccdf91a1e6e979374ce8ada61bec406510
Instruction Fuzzy Hash: 0A41E53160C3548FC305DF68C494A2EFBE6AF99304F098A1DD4D6D72A1CB75DE018B82

Function 0039D961 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b82e657d7678bf467dc8cae17034ff59fdc4e7efd0958ff7603e73890e7ad5a7
Instruction ID: 7f2f2d20b98dadf78a032f982f9b0a728f4e9b6d6f80be3b581c3d2a7f48f1d8
Opcode Fuzzy Hash: b82e657d7678bf467dc8cae17034ff59fdc4e7efd0958ff7603e73890e7ad5a7
Instruction Fuzzy Hash: 4641CBB16093818BD7359F14D882BAFB7B4FFA6364F04095DE48A8BB91E7748840CB57

Function 003BF030 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5be6113664422e96713363ec41851647c31506b086c17a8b3ff98e201e465e1
Instruction ID: f6a336e11969f45662de469758ba96ebecbb603adcb5aeaf053d19f25b7cd94d
Opcode Fuzzy Hash: c5be6113664422e96713363ec41851647c31506b086c17a8b3ff98e201e465e1
Instruction Fuzzy Hash: 5E210A329081144BC325EB6DC88157BF7E4EB99708F06963ED9C4A7295E3359C1487D1

Function 003C67EF Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd449e4c953a3a7a093b7e5dcc639bcadea91151af9b7ea8d5fc3334fdaff765
Instruction ID: b4f9e9e50463b1a416f9b82f47725b5bcdc53ac0282c7a3c3c63dfdec6a7d9c0
Opcode Fuzzy Hash: cd449e4c953a3a7a093b7e5dcc639bcadea91151af9b7ea8d5fc3334fdaff765
Instruction Fuzzy Hash: 503114705183829AD715CF14C4A1A2FBBF0EF96784F54581DF4C8AB261D338D985CB9A

Function 003A5E70 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65d3cd808260c5aff4f0eab0d058407948bef5809e639b39fafe96253252e3e4
Instruction ID: c140bdcdd86fd53f12222b082e9935aa2986a7983ad428287356479b6fc17c91
Opcode Fuzzy Hash: 65d3cd808260c5aff4f0eab0d058407948bef5809e639b39fafe96253252e3e4
Instruction Fuzzy Hash: B221AEB1509201DFC312AF28C85196BB7F8EF92764F45891CF4D99B292E334CA04CBA3

Function 003849A0 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbe2eee255ce80e2df90ed4850d7395439c2c852be5922ee4a7cea5853ec6c97
Instruction ID: 21c52a309a056871bb61f5fdd6620a649422f654a919064c7d152eb18ac0424a
Opcode Fuzzy Hash: cbe2eee255ce80e2df90ed4850d7395439c2c852be5922ee4a7cea5853ec6c97
Instruction Fuzzy Hash: 7D31FC31658302DBD716AF18D880A2BB7E1EFC4358F1989ADE89ACF641D335DC52CB46

Function 003C64B8 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80e59fef91a30f75ca277007d8012e0ec768cee928310dea1e86f77dbf4df1d6
Instruction ID: 089438b379859d1a502d5f1365eaad65e677e7e7fc7373812ab506f319b5da65
Opcode Fuzzy Hash: 80e59fef91a30f75ca277007d8012e0ec768cee928310dea1e86f77dbf4df1d6
Instruction Fuzzy Hash: BD21697450C2409BC70AEF1AE881E2EF7E9EB85741F29881CE4C4D3261C334AC50CB62

Function 003BB650 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: 1108131a46316bc7d31e033699cc19459e7a9692bd51eb4b7a1d602a3e1d891f
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 9011E933B051D44EC3178D3C84406A5FFA31AA3278B594399F4F49B6D2DB62CD8A8354

Function 003B0B80 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90022ddfb32469098a8610d4b68e70bc315f5b0e8987f5b71d64abe4c0da561b
Instruction ID: 5c089fb526433b8936ec60e0352046a3a568c239d2d1d697840c0772631ba64d
Opcode Fuzzy Hash: 90022ddfb32469098a8610d4b68e70bc315f5b0e8987f5b71d64abe4c0da561b
Instruction Fuzzy Hash: CF01D8F1A1030147EB2AEE50A4D0B7BB2A86F4071CF19452CD6064B701DB75EC04C3A1

Function 003AD1E1 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b12f72e144011d83c96de0dfb33f4c5246d9684089640167de37be8ab92dca6
Instruction ID: c0d0dbbc9e1fea81a5dc1eba4fd2e00dca872e8e3c54d6f56276f8663d8cc61c
Opcode Fuzzy Hash: 7b12f72e144011d83c96de0dfb33f4c5246d9684089640167de37be8ab92dca6
Instruction Fuzzy Hash: 0411ECB0418380AFD3119F61C494A2FFBE5EBA6714F148C0DF6A59B251C379E819CF56

Function 00386EA0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fe31a632853384ec4ace065b965f0f78bb904acfa8294e4ea48940a0eaafa37
Instruction ID: bdca6e403ef194dcd5d9ac00d544186a695f662056f707301f4f18d614482738
Opcode Fuzzy Hash: 7fe31a632853384ec4ace065b965f0f78bb904acfa8294e4ea48940a0eaafa37
Instruction Fuzzy Hash: A7F0243A71870A0BA212EDABE88083BF39AD7C9354F055538EA41C3201CE72F8069391

Function 003BB8C0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dad40b8a8b0cf0c680be38028a9801f4e1e9da1297b4f3b9e1d9df466e9bee7e
Instruction ID: 6506d07c58c905065930edc77b6421f51c28c54387ea28b09faa2761b04cb969
Opcode Fuzzy Hash: dad40b8a8b0cf0c680be38028a9801f4e1e9da1297b4f3b9e1d9df466e9bee7e
Instruction Fuzzy Hash: 1E0162B3A199610B8348CE3DDC1156BBAD15BD5770F19872DBEF5CB3E0D230C8118695

Function 0039C5F0 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8ebd7708255391ffa87ed53dd5dbf97c7cff7b52fcdad9dabb06971c835301f
Instruction ID: afd6f86e1ed7dc578beff9a6215ab27dc393fb41cabbec3b70aacfa27007612f
Opcode Fuzzy Hash: d8ebd7708255391ffa87ed53dd5dbf97c7cff7b52fcdad9dabb06971c835301f
Instruction Fuzzy Hash: EB014B72A196204B8308CE3C9C1112ABEE19B86330F158B2EBCFAD73E0D664CD548696

Function 0039B410 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 809ee23363f840c811a801533be2b64f834fb93f4c5a4ab9cc37b5a2fd812bb4
Instruction ID: 9fd7284b9a694fd22c27ddd96b7c6a4bb119aeec38a77ea4635a4f79e993e7ec
Opcode Fuzzy Hash: 809ee23363f840c811a801533be2b64f834fb93f4c5a4ab9cc37b5a2fd812bb4
Instruction Fuzzy Hash: CEF0ECB160451067DF238A95ACC0F37FB9CCB87354F190426E84557203D2A15845C3E5

Function 003B8220 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1f49734a28e563b533c893f3cb5840c085d40c16e2f71fa63cfcfa639b823b6
Instruction ID: 1a289c522bb477b9aad7dd1733f6c5ab8065b3ba29a2a0cd3eec8c3f83916047
Opcode Fuzzy Hash: b1f49734a28e563b533c893f3cb5840c085d40c16e2f71fa63cfcfa639b823b6
Instruction Fuzzy Hash: 7001EFB4410B009FC360EF29C845B4BBBE8EB08714F008A1DE8AECB680D770A5488B82

Function 003C1440 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction ID: 421ee9d1ad8ad5f460de2dec8042b2af240b16f6ac2f7a073b1973e49204f61c
Opcode Fuzzy Hash: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction Fuzzy Hash: 9AD05E31608321469B688E1AA400A77F7F0EA87B12B4A955EF586E3149D630DC41D2A9

Function 00391ACD Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa3a6fd210dbd0ac442ab09b4c01568c1c77a5f162521fa086e14c1906cf4e96
Instruction ID: c81b04ac120df8cf67e0be6bdad67af7e634f0714e63b106eaf07f35e10187cd
Opcode Fuzzy Hash: fa3a6fd210dbd0ac442ab09b4c01568c1c77a5f162521fa086e14c1906cf4e96
Instruction Fuzzy Hash: 8EC08C34A590018FC20ACF02FC95832B7BDA707308F80703ADA03F3721CA30E8168A09

Function 003C6094 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54775b7d6676f42b16936e6e6c81a5aa6f747a9427161d2d39cc4cb7a9683d5b
Instruction ID: e9c8eea0756a4e0d4032c2fd6d59914b07bc0f7ab16bb751beeb18ee0e861005
Opcode Fuzzy Hash: 54775b7d6676f42b16936e6e6c81a5aa6f747a9427161d2d39cc4cb7a9683d5b
Instruction Fuzzy Hash: 53C09B3465D004C7920DCF14F951975F37E9B9771CF24B01FC80663655C134DD12951D

Function 00391A3C Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45be6fa922217569a4c8dcb247be8969a1d618f39dc35a2c6da0fa74d65b8c4d
Instruction ID: 13319d892db63ee000edda4312d9d03ddc248f7c51d8d8358304ff67a8653e89
Opcode Fuzzy Hash: 45be6fa922217569a4c8dcb247be8969a1d618f39dc35a2c6da0fa74d65b8c4d
Instruction Fuzzy Hash: 0FC04C24A990418E86498E87A891831A6AD5706308B50303A9602F7661C560E4058609

Function 003C5FD6 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741230254.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1741062108.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741463947.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741588375.00000000003EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741636540.00000000003EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741684833.00000000003EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742322283.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742434828.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742467638.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742495858.000000000056D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742509601.0000000000573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742527811.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742540788.0000000000586000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742558174.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742571219.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742584829.000000000059C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742606918.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742625599.00000000005C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742641486.00000000005CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742656843.00000000005D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1742671760.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743108959.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743127735.00000000005E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743247498.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743262965.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743384611.00000000005ED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743439664.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743457107.00000000005FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743474878.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743488377.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743501754.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743514754.0000000000600000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743543201.0000000000604000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743556958.0000000000605000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743640549.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743696358.0000000000627000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743736429.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743750264.000000000062A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743763804.0000000000649000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743801675.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743815768.0000000000678000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743829907.000000000067E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743864569.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1743879207.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 604fe374edcd64556cf4bd86ab925204f1bf2bd0a6d0a7ff7693be8b095d850f
Instruction ID: 1a1a513217ed0a06aaaa8c9e084ff690bff30e031ecaa31f0c96b88796c1135d
Opcode Fuzzy Hash: 604fe374edcd64556cf4bd86ab925204f1bf2bd0a6d0a7ff7693be8b095d850f
Instruction Fuzzy Hash: 57C09224B6A0008BA24DCF28ED51935F3BE9B8BB1CF14B02FC806A3256D134D912860D

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Boot Survival

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Windows Analysis Report
file.exe

Function 0038FCA0 Relevance: 5.4, Strings: 4, Instructions: 373
COMMON

Function 0038D110 Relevance: 1.7, APIs: 1, Instructions: 168
COMMON

Function 003C5700 Relevance: 1.6, APIs: 1, Instructions: 69
memoryCOMMON

Function 003C5BB0 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Function 003C695B Relevance: 1.4, Strings: 1, Instructions: 100
COMMON

Function 0039049B Relevance: .3, Instructions: 264
COMMON

Function 00390228 Relevance: .2, Instructions: 218
COMMON

Function 003C3220 Relevance: 1.6, APIs: 1, Instructions: 59
memoryCOMMON

Function 003C3202 Relevance: 1.5, APIs: 1, Instructions: 6
memoryCOMMON