Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1541197
MD5:	83358e80d76d88ca2a9b071c0b0125d8
SHA1:	df938b308f8d3ba4374d5e6cb9e3052e1a785d70
SHA256:	360de1bff31fd900b6a8c06f9041f0276e3a3aaf4a882c816ecae09fbb13bbfe
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

PE file contains section with special chars

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Detected potential crypto function

Entry point lies outside standard sections

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 4420 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 83358E80D76D88CA2A9B071C0B0125D8)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["spirittunek.store", "bathdoomgaz.store", "mobbipenju.store", "dissapoiznw.store", "eaglepawnoy.store", "studennotediw.store", "licendfilteo.site", "clearancek.site"], "Build id": "4SD0y4--legendaryy"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T15:09:08.355879+0200	2056477	1	Domain Observed Used for C2 Detected	192.168.2.6	60356	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T15:09:08.270599+0200	2056471	1	Domain Observed Used for C2 Detected	192.168.2.6	62145	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T15:09:08.329193+0200	2056481	1	Domain Observed Used for C2 Detected	192.168.2.6	57697	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T15:09:08.314361+0200	2056483	1	Domain Observed Used for C2 Detected	192.168.2.6	63671	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T15:09:08.378731+0200	2056473	1	Domain Observed Used for C2 Detected	192.168.2.6	57448	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T15:09:08.290387+0200	2056485	1	Domain Observed Used for C2 Detected	192.168.2.6	56907	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T15:09:08.368088+0200	2056475	1	Domain Observed Used for C2 Detected	192.168.2.6	55191	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T15:09:08.342608+0200	2056479	1	Domain Observed Used for C2 Detected	192.168.2.6	62219	1.1.1.1	53	UDP

ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T15:09:09.948537+0200	2858666	1	Domain Observed Used for C2 Detected	192.168.2.6	49708	104.102.49.254	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://steamcommunity.com:443/profiles/76561199724331900

URL Reputation: Label: malware

Found malware configuration

Source: file.exe.4420.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["spirittunek.store", "bathdoomgaz.store", "mobbipenju.store", "dissapoiznw.store", "eaglepawnoy.store", "studennotediw.store", "licendfilteo.site", "clearancek.site"], "Build id": "4SD0y4--legendaryy"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp	String decryptor: clearancek.site
Source: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp	String decryptor: licendfilteo.site
Source: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp	String decryptor: spirittunek.store
Source: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp	String decryptor: bathdoomgaz.store
Source: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp	String decryptor: studennotediw.store
Source: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp	String decryptor: dissapoiznw.store
Source: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp	String decryptor: eaglepawnoy.store
Source: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp	String decryptor: mobbipenju.store
Source: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp	String decryptor: clearancek.site
Source: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp	String decryptor: 4SD0y4--legendaryy

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.6:49708 version: TLS 1.2

Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_0079D110
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_0079D110
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	0_2_007D63B8
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_007D5700
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 27BAF212h	0_2_007D695B
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	0_2_007D99D0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	0_2_0079FCA0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	0_2_007A0EEC
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	0_2_007D4040
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then dec ebx	0_2_007CF030
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+20h]	0_2_007A6F91
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ecx, dword ptr [edx]	0_2_00791000
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp ecx	0_2_007D6094
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	0_2_007BD1E1
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_007B2260
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [esi], ax	0_2_007B2260
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	0_2_007A42FC
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ebp, eax	0_2_0079A300
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_007C23E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_007C23E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_007C23E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_007C23E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_007C23E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+14h]	0_2_007C23E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	0_2_007BC470
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_007AD457
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx eax, word ptr [esi+ecx]	0_2_007D1440
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov dword ptr [esp], 00000000h	0_2_007AB410
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	0_2_007BE40C
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	0_2_007D64B8
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	0_2_007A6536
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 7789B0CBh	0_2_007D7520
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_007B9510
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ebx, byte ptr [ecx+esi+25h]	0_2_00798590
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	0_2_007BE66A
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	0_2_007CB650
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ecx, word ptr [edi+eax]	0_2_007D7710
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	0_2_007D67EF
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	0_2_007BD7AF
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_007B28E9
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	0_2_007AD961
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 62429966h	0_2_007D3920
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	0_2_007949A0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ebx]	0_2_00795A50
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	0_2_007D4A40
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	0_2_007A1A3C
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	0_2_007A1ACD
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+000006B8h]	0_2_007ADB6F
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F8FD61B8h	0_2_007ADB6F
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	0_2_007D9B60
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	0_2_007A1BEE
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	0_2_007A3BE2
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	0_2_007C0B80
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp word ptr [eax+esi+02h], 0000h	0_2_007BEC48
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], A70A987Fh	0_2_007CFC20
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	0_2_007B7C00
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_007D9CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebp+edx*8+00h], 9ECF05EBh	0_2_007D9CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], C85F7986h	0_2_007BCCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_007BCCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C85F7986h	0_2_007BCCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	0_2_007BAC91
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [edx], ax	0_2_007BAC91
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	0_2_007BDD29
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov dword ptr [esp+1Ch], 5E46585Eh	0_2_007BFD10
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_007D8D8A
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_007B5E70
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_007B7E60
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ebx, word ptr [ecx]	0_2_007BAE57
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov edi, ecx	0_2_007A4E2A
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp byte ptr [ebx], 00000000h	0_2_007A6EBF
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ecx, word ptr [ebp+00h]	0_2_0079BEB0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edi, byte ptr [ecx+esi]	0_2_00796EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	0_2_007A1E93
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_007CFF70
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	0_2_007B9F62
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [edx], 0000h	0_2_007AFFDF
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp ecx	0_2_00798FD0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp ecx	0_2_007D5FD6
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], F3285E74h	0_2_007D7FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_007D7FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+20h]	0_2_007A6F91

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2056479 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store) : 192.168.2.6:62219 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056483 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store) : 192.168.2.6:63671 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056485 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store) : 192.168.2.6:56907 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056481 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store) : 192.168.2.6:57697 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056477 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store) : 192.168.2.6:60356 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056475 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store) : 192.168.2.6:55191 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056471 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site) : 192.168.2.6:62145 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056473 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site) : 192.168.2.6:57448 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.6:49708 -> 104.102.49.254:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: spirittunek.store
Source: Malware configuration extractor	URLs: bathdoomgaz.store
Source: Malware configuration extractor	URLs: mobbipenju.store
Source: Malware configuration extractor	URLs: dissapoiznw.store
Source: Malware configuration extractor	URLs: eaglepawnoy.store
Source: Malware configuration extractor	URLs: studennotediw.store
Source: Malware configuration extractor	URLs: licendfilteo.site
Source: Malware configuration extractor	URLs: clearancek.site

Source: Joe Sandbox View

IP Address: 104.102.49.254 104.102.49.254

Source: Joe Sandbox View

ASN Name: AKAMAI-ASUS AKAMAI-ASUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic

HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

Source: file.exe, 00000000.00000002.2175755698.0000000001369000.00000004.00000020.00020000.00000000.sdmp

String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: clearancek.site
Source: global traffic	DNS traffic detected: DNS query: mobbipenju.store
Source: global traffic	DNS traffic detected: DNS query: eaglepawnoy.store
Source: global traffic	DNS traffic detected: DNS query: dissapoiznw.store
Source: global traffic	DNS traffic detected: DNS query: studennotediw.store
Source: global traffic	DNS traffic detected: DNS query: bathdoomgaz.store
Source: global traffic	DNS traffic detected: DNS query: spirittunek.store
Source: global traffic	DNS traffic detected: DNS query: licendfilteo.site
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com

Source: file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2175755698.0000000001369000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: file.exe, 00000000.00000003.2170794589.0000000001355000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2175835083.00000000013A2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170949966.00000000013A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: file.exe, 00000000.00000003.2170794589.0000000001355000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2175835083.00000000013A2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170949966.00000000013A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: file.exe, 00000000.00000003.2170794589.0000000001355000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2175835083.00000000013A2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170949966.00000000013A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: file.exe, 00000000.00000002.2175755698.0000000001369000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: file.exe, 00000000.00000002.2175546958.000000000131E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bathdoomgaz.store:443/api
Source: file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2175755698.0000000001369000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2175755698.0000000001369000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/
Source: file.exe, 00000000.00000002.2175755698.0000000001369000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: file.exe, 00000000.00000002.2175546958.000000000131E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clearancek.site:443/apip
Source: file.exe, 00000000.00000002.2175755698.0000000001369000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/
Source: file.exe, 00000000.00000002.2175835083.00000000013A2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2175546958.0000000001334000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170949966.00000000013A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/applications/community/main.css?v=ljhW-PbGuX
Source: file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170949966.00000000013A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/globalv2.css?v=pwVcIAtHNXwg&l=english&am
Source: file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170949966.00000000013A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/fatalerror.css?v=wctRWaBvNt2z&l=e
Source: file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170949966.00000000013A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/header.css?v=vh4BMeDcNiCU&l=engli
Source: file.exe, 00000000.00000002.2175835083.00000000013A2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170949966.00000000013A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: file.exe, 00000000.00000002.2175835083.00000000013A2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2175546958.0000000001334000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170949966.00000000013A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/libraries~b28b
Source: file.exe, 00000000.00000002.2175835083.00000000013A2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2175546958.0000000001334000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170949966.00000000013A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/main.js?v=W9BX
Source: file.exe, 00000000.00000002.2175835083.00000000013A2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2175546958.0000000001334000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170949966.00000000013A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/manifest.js?v=
Source: file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170949966.00000000013A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/global.js?v=bOP7RorZq4_W&l=englis
Source: file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170949966.00000000013A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC&
Source: file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170949966.00000000013A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw&
Source: file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170949966.00000000013A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpE
Source: file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170949966.00000000013A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/buttons.css?v=tuNiaSwXwcYT&l=engl
Source: file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170949966.00000000013A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/motiva_sans.css?v=GfSjbGKcNYaQ&l=
Source: file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170949966.00000000013A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/shared_global.css?v=Ff_1prscqzeu&
Source: file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170949966.00000000013A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/shared_responsive.css?v=eghn9DNyCY67&
Source: file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.p
Source: file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170949966.00000000013A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1
Source: file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170949966.00000000013A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_global.js?v=wJD9maDpDcV
Source: file.exe, 00000000.00000002.2175835083.00000000013A2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170949966.00000000013A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v
Source: file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170949966.00000000013A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0&amp
Source: file.exe, 00000000.00000002.2175546958.000000000131E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dissapoiznw.store:443/api
Source: file.exe, 00000000.00000002.2175755698.0000000001369000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: file.exe, 00000000.00000002.2175546958.000000000131E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://licendfilteo.site:443/api
Source: file.exe, 00000000.00000002.2175755698.0000000001369000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2175755698.0000000001369000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2175755698.0000000001369000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: file.exe, 00000000.00000002.2175546958.000000000131E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mobbipenju.store:443/api
Source: file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2175755698.0000000001369000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2175755698.0000000001369000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2175755698.0000000001369000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2175755698.0000000001369000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2175755698.0000000001369000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: file.exe, 00000000.00000002.2175546958.000000000131E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://spirittunek.store:443/api
Source: file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2175755698.0000000001369000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2175755698.0000000001369000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2175755698.0000000001369000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2175755698.0000000001369000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: file.exe, 00000000.00000002.2175835083.00000000013A2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2175546958.0000000001334000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170949966.00000000013A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com
Source: file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2175546958.0000000001313000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2175755698.0000000001369000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: file.exe, 00000000.00000003.2170794589.0000000001355000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2175835083.00000000013A2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170949966.00000000013A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170949966.00000000013A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: file.exe, 00000000.00000002.2175546958.0000000001334000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: file.exe, 00000000.00000002.2175546958.000000000131E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com:443/profiles/76561199724331900
Source: file.exe, 00000000.00000002.2175755698.0000000001369000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2175755698.0000000001369000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: file.exe, 00000000.00000002.2175835083.00000000013A2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170949966.00000000013A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: file.exe, 00000000.00000003.2170794589.0000000001355000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2175835083.00000000013A2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170949966.00000000013A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: file.exe, 00000000.00000002.2175546958.000000000131E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://studennotediw.store:443/api6
Source: file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2175755698.0000000001369000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: file.exe, 00000000.00000002.2175755698.0000000001369000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2175755698.0000000001369000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2175755698.0000000001369000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: file.exe, 00000000.00000003.2170794589.0000000001355000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2175835083.00000000013A2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170949966.00000000013A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2175755698.0000000001369000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2175755698.0000000001369000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708

Source: unknown

HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.6:49708 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007A0228	0_2_007A0228
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007D4040	0_2_007D4040
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007A2030	0_2_007A2030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00791000	0_2_00791000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007DA0D0	0_2_007DA0D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B8055	0_2_009B8055
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00795160	0_2_00795160
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007971F0	0_2_007971F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0094E136	0_2_0094E136
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0079E1A0	0_2_0079E1A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007912F7	0_2_007912F7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007C82D0	0_2_007C82D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007C12D0	0_2_007C12D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008D4390	0_2_008D4390
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0079A300	0_2_0079A300
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007C23E0	0_2_007C23E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0079B3A0	0_2_0079B3A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007913A3	0_2_007913A3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007BC470	0_2_007BC470
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007C64F0	0_2_007C64F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007A049B	0_2_007A049B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007A4487	0_2_007A4487
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0085E589	0_2_0085E589
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007AC5F0	0_2_007AC5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007935B0	0_2_007935B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00798590	0_2_00798590
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007D8652	0_2_007D8652
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0079164F	0_2_0079164F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007CF620	0_2_007CF620
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009566F9	0_2_009566F9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007D86F0	0_2_007D86F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00951636	0_2_00951636
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007C1860	0_2_007C1860
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0079A850	0_2_0079A850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009558CC	0_2_009558CC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007CB8C0	0_2_007CB8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007CE8A0	0_2_007CE8A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0094C959	0_2_0094C959
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007D89A0	0_2_007D89A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007B098B	0_2_007B098B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007D4A40	0_2_007D4A40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007D7AB0	0_2_007D7AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007D8A80	0_2_007D8A80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007ADB6F	0_2_007ADB6F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0092BBB6	0_2_0092BBB6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00949BB0	0_2_00949BB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00797BF0	0_2_00797BF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00958B0C	0_2_00958B0C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0094AB2B	0_2_0094AB2B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0094FB7A	0_2_0094FB7A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007D8C02	0_2_007D8C02
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007BCCD0	0_2_007BCCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007D6CBF	0_2_007D6CBF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008BFC66	0_2_008BFC66
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007B8D62	0_2_007B8D62
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007BDD29	0_2_007BDD29
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007BFD10	0_2_007BFD10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007D8E70	0_2_007D8E70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007BAE57	0_2_007BAE57
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007A4E2A	0_2_007A4E2A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007A6EBF	0_2_007A6EBF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0079BEB0	0_2_0079BEB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0079AF10	0_2_0079AF10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00798FD0	0_2_00798FD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007D7FC0	0_2_007D7FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00912F74	0_2_00912F74

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 0079CAA0 appears 48 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 007AD300 appears 152 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: ZLIB complexity 0.9994520936468647

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@9/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_007C8220 CoCreateInstance,

0_2_007C8220

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: file.exe	String found in binary or memory: 'RtlAllocateHeap3Cannot find '%s'. Please, re-install this applicationThunRTMain__vbaVarTstNe

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior

Source: file.exe

Static file information: File size 2921984 > 1048576

Source: file.exe

Static PE information: Raw size of qgwqnumb is bigger than: 0x100000 < 0x2a0000

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.790000.0.unpack :EW;.rsrc :W;.idata :W;qgwqnumb:EW;texvacgq:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W;qgwqnumb:EW;texvacgq:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x2d74f6 should be: 0x2cd0f3

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name: qgwqnumb
Source: file.exe	Static PE information: section name: texvacgq
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009C900C push ebp; mov dword ptr [esp], ecx	0_2_009C902B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009C900C push esi; mov dword ptr [esp], ecx	0_2_009C9068
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A9003C push edi; mov dword ptr [esp], eax	0_2_00A900B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A9003C push edx; mov dword ptr [esp], 7EFE96BCh	0_2_00A9010A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A9003C push ebx; mov dword ptr [esp], 7FF1E234h	0_2_00A9013A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A90000 push 3F051E7Fh; mov dword ptr [esp], ecx	0_2_00A9002D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B8055 push ebx; mov dword ptr [esp], eax	0_2_009B8069
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B8055 push ebx; mov dword ptr [esp], esi	0_2_009B80AE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B8055 push esi; mov dword ptr [esp], 17FF4067h	0_2_009B80BB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B8055 push edx; mov dword ptr [esp], eax	0_2_009B8102
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B8055 push eax; mov dword ptr [esp], 7DC32BD1h	0_2_009B81C5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B8055 push ebp; mov dword ptr [esp], ecx	0_2_009B81FD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B8055 push ecx; mov dword ptr [esp], eax	0_2_009B8201
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009EF07F push 4EDF9D33h; mov dword ptr [esp], edi	0_2_009EF0B9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009F7072 push ecx; mov dword ptr [esp], esi	0_2_009F709B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0097A18E push ecx; mov dword ptr [esp], edi	0_2_0097A25C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A90197 push ecx; mov dword ptr [esp], ebp	0_2_00A90198
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A90197 push edi; mov dword ptr [esp], esi	0_2_00A901C9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A90197 push ecx; mov dword ptr [esp], 393FE79Ah	0_2_00A901DF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A90197 push eax; mov dword ptr [esp], edx	0_2_00A90265
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A66126 push ebx; mov dword ptr [esp], esi	0_2_00A66130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A66126 push esi; mov dword ptr [esp], edi	0_2_00A661D7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0094E136 push 12363515h; mov dword ptr [esp], esi	0_2_0094E14B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0094E136 push 20015B1Ah; mov dword ptr [esp], esp	0_2_0094E184
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0094E136 push edx; mov dword ptr [esp], 5C632989h	0_2_0094E1B8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0094E136 push ebp; mov dword ptr [esp], eax	0_2_0094E1F5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0094E136 push ebp; mov dword ptr [esp], 7FF7D951h	0_2_0094E1FA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0094E136 push 588E99A5h; mov dword ptr [esp], edx	0_2_0094E253
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0094E136 push 05E57A15h; mov dword ptr [esp], edx	0_2_0094E285
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0094E136 push ebx; mov dword ptr [esp], esp	0_2_0094E2DC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0094E136 push edx; mov dword ptr [esp], ecx	0_2_0094E2F8

Source: file.exe

Static PE information: section name: entropy: 7.977968387175993

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F42B7 second address: 7F42EF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F5244B935ACh 0x00000008 jno 00007F5244B935A6h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 jnc 00007F5244B935C4h 0x00000018 pushad 0x00000019 jmp 00007F5244B935B6h 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F42EF second address: 7F3AB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 or dword ptr [ebp+122D250Ah], esi 0x0000000c pushad 0x0000000d mov ebx, dword ptr [ebp+122D2B5Eh] 0x00000013 mov ecx, dword ptr [ebp+122D2C2Eh] 0x00000019 popad 0x0000001a push dword ptr [ebp+122D04BDh] 0x00000020 sub dword ptr [ebp+122D27E7h], ecx 0x00000026 call dword ptr [ebp+122D280Dh] 0x0000002c pushad 0x0000002d cmc 0x0000002e xor eax, eax 0x00000030 sub dword ptr [ebp+122D25DAh], esi 0x00000036 jne 00007F5245261504h 0x0000003c mov edx, dword ptr [esp+28h] 0x00000040 pushad 0x00000041 call 00007F5245261502h 0x00000046 pop esi 0x00000047 push edi 0x00000048 je 00007F52452614F6h 0x0000004e pop ebx 0x0000004f popad 0x00000050 mov dword ptr [ebp+122D2A92h], eax 0x00000056 pushad 0x00000057 mov esi, eax 0x00000059 mov esi, dword ptr [ebp+122D2AAEh] 0x0000005f popad 0x00000060 mov esi, 0000003Ch 0x00000065 mov dword ptr [ebp+122D25DAh], esi 0x0000006b add esi, dword ptr [esp+24h] 0x0000006f jmp 00007F5245261502h 0x00000074 lodsw 0x00000076 clc 0x00000077 add eax, dword ptr [esp+24h] 0x0000007b or dword ptr [ebp+122D282Ch], edx 0x00000081 mov ebx, dword ptr [esp+24h] 0x00000085 clc 0x00000086 push eax 0x00000087 push eax 0x00000088 push edx 0x00000089 pushad 0x0000008a push eax 0x0000008b push edx 0x0000008c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F3AB5 second address: 7F3AC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F5244B935A6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95E1E7 second address: 95E1ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 952BC4 second address: 952BD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push ebx 0x0000000a push esi 0x0000000b pop esi 0x0000000c pushad 0x0000000d popad 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 952BD7 second address: 952BDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95D0A4 second address: 95D0B3 instructions: 0x00000000 rdtsc 0x00000002 je 00007F5244B935A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push edx 0x0000000c pop edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95D0B3 second address: 95D0C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F52452614F6h 0x0000000a popad 0x0000000b ja 00007F52452614FCh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95D0C6 second address: 95D0F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5244B935ABh 0x00000009 popad 0x0000000a js 00007F5244B935D1h 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F5244B935B3h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95D28A second address: 95D298 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F52452614FEh 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95D298 second address: 95D29F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95D418 second address: 95D41C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95D70B second address: 95D711 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95D711 second address: 95D717 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95D717 second address: 95D71B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95D71B second address: 95D736 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F5245261502h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95D736 second address: 95D75A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5244B935AEh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jnc 00007F5244B935A8h 0x00000014 push ecx 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95D75A second address: 95D75F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95D75F second address: 95D76B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F5244B935A6h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95D76B second address: 95D76F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95DA49 second address: 95DA66 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F5244B935B2h 0x00000008 pop edi 0x00000009 pushad 0x0000000a push eax 0x0000000b pop eax 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95DA66 second address: 95DA74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95DA74 second address: 95DA86 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5244B935AEh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95DA86 second address: 95DAAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F5245261506h 0x0000000b push eax 0x0000000c push edx 0x0000000d jp 00007F52452614F6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95F814 second address: 95F8AF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 xor dword ptr [esp], 080DE4F5h 0x0000000e push eax 0x0000000f pushad 0x00000010 xor eax, dword ptr [ebp+122D2CC6h] 0x00000016 or eax, 66D552E8h 0x0000001c popad 0x0000001d pop ecx 0x0000001e push 00000003h 0x00000020 movzx edi, si 0x00000023 push 00000000h 0x00000025 call 00007F5244B935AAh 0x0000002a mov esi, dword ptr [ebp+122D32E4h] 0x00000030 pop edi 0x00000031 push 00000003h 0x00000033 cmc 0x00000034 adc dh, 00000001h 0x00000037 push C0372976h 0x0000003c push edx 0x0000003d ja 00007F5244B935A8h 0x00000043 pop edx 0x00000044 xor dword ptr [esp], 00372976h 0x0000004b push 00000000h 0x0000004d push edi 0x0000004e call 00007F5244B935A8h 0x00000053 pop edi 0x00000054 mov dword ptr [esp+04h], edi 0x00000058 add dword ptr [esp+04h], 00000018h 0x00000060 inc edi 0x00000061 push edi 0x00000062 ret 0x00000063 pop edi 0x00000064 ret 0x00000065 lea ebx, dword ptr [ebp+1243F299h] 0x0000006b movzx edi, bx 0x0000006e xchg eax, ebx 0x0000006f jmp 00007F5244B935B9h 0x00000074 push eax 0x00000075 push eax 0x00000076 push edx 0x00000077 push ecx 0x00000078 push eax 0x00000079 push edx 0x0000007a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95F8AF second address: 95F8B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95F8B4 second address: 95F8BE instructions: 0x00000000 rdtsc 0x00000002 jl 00007F5244B935ACh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97FB9C second address: 97FBA2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97FD13 second address: 97FD18 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97FF91 second address: 97FF95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97FF95 second address: 97FF99 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9561F4 second address: 956214 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5245261508h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 980563 second address: 98056D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F5244B935A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98056D second address: 980579 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F52452614F6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 980579 second address: 980581 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 pop esi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 980581 second address: 98058C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98058C second address: 98059A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98059A second address: 98059F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98059F second address: 9805A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9805A7 second address: 9805AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9805AB second address: 9805B6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 980B14 second address: 980B1D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 980B1D second address: 980B24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 980B24 second address: 980B2C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9846E4 second address: 9846EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9846EA second address: 9846FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F52452614F6h 0x0000000a popad 0x0000000b push esi 0x0000000c push edi 0x0000000d pop edi 0x0000000e push eax 0x0000000f pop eax 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9846FB second address: 984700 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 984700 second address: 98470E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98470E second address: 984712 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 986DA0 second address: 986DA6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 986DA6 second address: 986DAA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98F0D4 second address: 98F0F8 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F52452614FEh 0x00000008 pop edi 0x00000009 je 00007F52452614F8h 0x0000000f pushad 0x00000010 popad 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pushad 0x00000014 pushad 0x00000015 push edx 0x00000016 pop edx 0x00000017 pushad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 957D1F second address: 957D3C instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F5244B935B2h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 957D3C second address: 957D42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 957D42 second address: 957D47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98E4C6 second address: 98E4D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F52452614F6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98E4D1 second address: 98E4D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98E4D6 second address: 98E4DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98E64B second address: 98E667 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5244B935AAh 0x00000007 jg 00007F5244B935A6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jns 00007F5244B935A6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98E667 second address: 98E6A3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b jmp 00007F5245261505h 0x00000010 jmp 00007F52452614FEh 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F52452614FBh 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98E80A second address: 98E81B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F5244B935ACh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98E974 second address: 98E98B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 push edx 0x00000009 pop edx 0x0000000a push eax 0x0000000b pop eax 0x0000000c jmp 00007F52452614FAh 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98E98B second address: 98E992 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98EDE2 second address: 98EDF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c pop edi 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98EDF1 second address: 98EE36 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F5244B935A6h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jno 00007F5244B935B2h 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F5244B935B2h 0x00000019 jmp 00007F5244B935B3h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98EE36 second address: 98EE4A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F52452614FBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push esi 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 990F8B second address: 990F95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 990F95 second address: 990FA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9913C4 second address: 9913CE instructions: 0x00000000 rdtsc 0x00000002 jng 00007F5244B935ACh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9913CE second address: 9913DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 push edi 0x00000009 pushad 0x0000000a popad 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 991728 second address: 991733 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007F5244B935A6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 991CB4 second address: 991CBA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 991E69 second address: 991E6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 991E6D second address: 991E85 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5245261504h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 992011 second address: 992016 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 992016 second address: 992025 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push esi 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 992025 second address: 99202B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9926D9 second address: 9926DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 993110 second address: 993116 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9941C2 second address: 9941C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9941C6 second address: 9941CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 995E8D second address: 995E9F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F52452614FEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9976CA second address: 9976CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99745A second address: 99745E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9976CE second address: 997732 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5244B935B7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push eax 0x00000010 call 00007F5244B935A8h 0x00000015 pop eax 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a add dword ptr [esp+04h], 00000016h 0x00000022 inc eax 0x00000023 push eax 0x00000024 ret 0x00000025 pop eax 0x00000026 ret 0x00000027 push 00000000h 0x00000029 push 00000000h 0x0000002b add dword ptr [ebp+122D25E0h], edx 0x00000031 xchg eax, ebx 0x00000032 push eax 0x00000033 push edx 0x00000034 push eax 0x00000035 jmp 00007F5244B935B8h 0x0000003a pop eax 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 997732 second address: 997738 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 998CB0 second address: 998CB6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99B2C3 second address: 99B2CD instructions: 0x00000000 rdtsc 0x00000002 jc 00007F52452614FCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99A39B second address: 99A3C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5244B935B4h 0x00000009 popad 0x0000000a pop edi 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007F5244B935ACh 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99C4B2 second address: 99C4BC instructions: 0x00000000 rdtsc 0x00000002 jg 00007F52452614F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99C4BC second address: 99C547 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F5244B935B4h 0x00000008 push esi 0x00000009 pop esi 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push edi 0x00000011 call 00007F5244B935A8h 0x00000016 pop edi 0x00000017 mov dword ptr [esp+04h], edi 0x0000001b add dword ptr [esp+04h], 0000001Dh 0x00000023 inc edi 0x00000024 push edi 0x00000025 ret 0x00000026 pop edi 0x00000027 ret 0x00000028 xor di, A743h 0x0000002d xor dword ptr [ebp+122D29B4h], edx 0x00000033 push 00000000h 0x00000035 push 00000000h 0x00000037 push esi 0x00000038 call 00007F5244B935A8h 0x0000003d pop esi 0x0000003e mov dword ptr [esp+04h], esi 0x00000042 add dword ptr [esp+04h], 0000001Dh 0x0000004a inc esi 0x0000004b push esi 0x0000004c ret 0x0000004d pop esi 0x0000004e ret 0x0000004f mov edi, 309D88FDh 0x00000054 push 00000000h 0x00000056 sbb di, 4153h 0x0000005b xchg eax, esi 0x0000005c push eax 0x0000005d push edx 0x0000005e je 00007F5244B935A8h 0x00000064 push edi 0x00000065 pop edi 0x00000066 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99D559 second address: 99D563 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F52452614F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99C820 second address: 99C826 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A0D98 second address: 9A0D9E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A0D9E second address: 9A0DA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A0DA2 second address: 9A0DD3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F52452614FFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F5245261507h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A0DD3 second address: 9A0DDD instructions: 0x00000000 rdtsc 0x00000002 js 00007F5244B935A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A1E76 second address: 9A1E7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A0F6C second address: 9A0F82 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5244B935ADh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A2011 second address: 9A2015 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A3FA7 second address: 9A4027 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a mov ebx, 68212CDAh 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push edx 0x00000014 call 00007F5244B935A8h 0x00000019 pop edx 0x0000001a mov dword ptr [esp+04h], edx 0x0000001e add dword ptr [esp+04h], 0000001Dh 0x00000026 inc edx 0x00000027 push edx 0x00000028 ret 0x00000029 pop edx 0x0000002a ret 0x0000002b mov bl, A4h 0x0000002d jmp 00007F5244B935B2h 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push edi 0x00000037 call 00007F5244B935A8h 0x0000003c pop edi 0x0000003d mov dword ptr [esp+04h], edi 0x00000041 add dword ptr [esp+04h], 0000001Ch 0x00000049 inc edi 0x0000004a push edi 0x0000004b ret 0x0000004c pop edi 0x0000004d ret 0x0000004e mov dword ptr [ebp+122D2A11h], ecx 0x00000054 push eax 0x00000055 push eax 0x00000056 jng 00007F5244B935ACh 0x0000005c push eax 0x0000005d push edx 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A3145 second address: 9A314A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A1044 second address: 9A1069 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5244B935B0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jl 00007F5244B935A6h 0x00000013 jp 00007F5244B935A6h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A314A second address: 9A31E3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F52452614FFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov ebx, dword ptr [ebp+122D2ADEh] 0x00000012 push dword ptr fs:[00000000h] 0x00000019 movsx edi, bx 0x0000001c mov dword ptr fs:[00000000h], esp 0x00000023 mov eax, dword ptr [ebp+122D0DD5h] 0x00000029 push 00000000h 0x0000002b push ebx 0x0000002c call 00007F52452614F8h 0x00000031 pop ebx 0x00000032 mov dword ptr [esp+04h], ebx 0x00000036 add dword ptr [esp+04h], 0000001Bh 0x0000003e inc ebx 0x0000003f push ebx 0x00000040 ret 0x00000041 pop ebx 0x00000042 ret 0x00000043 xor di, 5F00h 0x00000048 push FFFFFFFFh 0x0000004a push 00000000h 0x0000004c push eax 0x0000004d call 00007F52452614F8h 0x00000052 pop eax 0x00000053 mov dword ptr [esp+04h], eax 0x00000057 add dword ptr [esp+04h], 00000019h 0x0000005f inc eax 0x00000060 push eax 0x00000061 ret 0x00000062 pop eax 0x00000063 ret 0x00000064 call 00007F5245261504h 0x00000069 pop ebx 0x0000006a push eax 0x0000006b push eax 0x0000006c push edx 0x0000006d pushad 0x0000006e push eax 0x0000006f push edx 0x00000070 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A210E second address: 9A2114 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A2114 second address: 9A211E instructions: 0x00000000 rdtsc 0x00000002 je 00007F52452614FCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A31E3 second address: 9A31EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A52A9 second address: 9A52B3 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F52452614F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A52B3 second address: 9A52C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5244B935B0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A73CD second address: 9A743B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push ecx 0x00000006 push eax 0x00000007 pop eax 0x00000008 pop ecx 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d pushad 0x0000000e mov ax, di 0x00000011 mov ah, 57h 0x00000013 popad 0x00000014 xor dword ptr [ebp+122D1C74h], edi 0x0000001a push dword ptr fs:[00000000h] 0x00000021 movsx edi, ax 0x00000024 mov dword ptr fs:[00000000h], esp 0x0000002b push 00000000h 0x0000002d push ecx 0x0000002e call 00007F52452614F8h 0x00000033 pop ecx 0x00000034 mov dword ptr [esp+04h], ecx 0x00000038 add dword ptr [esp+04h], 0000001Dh 0x00000040 inc ecx 0x00000041 push ecx 0x00000042 ret 0x00000043 pop ecx 0x00000044 ret 0x00000045 mov di, E673h 0x00000049 mov eax, dword ptr [ebp+122D0A1Dh] 0x0000004f mov dword ptr [ebp+122D27B9h], edi 0x00000055 push FFFFFFFFh 0x00000057 mov edi, 0616CF18h 0x0000005c push eax 0x0000005d push eax 0x0000005e push edx 0x0000005f push eax 0x00000060 push edx 0x00000061 push eax 0x00000062 push edx 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A743B second address: 9A743F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A743F second address: 9A7454 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5245261501h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A9368 second address: 9A93EE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5244B935B6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push esi 0x0000000f call 00007F5244B935A8h 0x00000014 pop esi 0x00000015 mov dword ptr [esp+04h], esi 0x00000019 add dword ptr [esp+04h], 0000001Dh 0x00000021 inc esi 0x00000022 push esi 0x00000023 ret 0x00000024 pop esi 0x00000025 ret 0x00000026 call 00007F5244B935AEh 0x0000002b mov bx, F7B9h 0x0000002f pop ebx 0x00000030 push 00000000h 0x00000032 push 00000000h 0x00000034 push edx 0x00000035 call 00007F5244B935A8h 0x0000003a pop edx 0x0000003b mov dword ptr [esp+04h], edx 0x0000003f add dword ptr [esp+04h], 0000001Dh 0x00000047 inc edx 0x00000048 push edx 0x00000049 ret 0x0000004a pop edx 0x0000004b ret 0x0000004c adc bl, 00000006h 0x0000004f push 00000000h 0x00000051 xchg eax, esi 0x00000052 pushad 0x00000053 pushad 0x00000054 push eax 0x00000055 push edx 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AA2C1 second address: 9AA2DA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F52452614FFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AA2DA second address: 9AA2E3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AA53F second address: 9AA543 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AA543 second address: 9AA549 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AEBB6 second address: 9AEBBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AEBBC second address: 9AEBC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AEBC1 second address: 9AEBDF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jmp 00007F5245261508h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B447F second address: 9B44AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5244B935AFh 0x00000009 jnp 00007F5244B935A8h 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F5244B935B3h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B44AF second address: 9B44ED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5245261501h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F5245261509h 0x00000011 jmp 00007F52452614FDh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B44ED second address: 9B44F4 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B44F4 second address: 9B450F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F5245261504h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 948CFB second address: 948CFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 948CFF second address: 948D05 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B3E2F second address: 9B3E35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B3F93 second address: 9B3FA4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F52452614FBh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B3FA4 second address: 9B3FC1 instructions: 0x00000000 rdtsc 0x00000002 je 00007F5244B935B7h 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B3FC1 second address: 9B3FC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B3FC5 second address: 9B3FD9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jc 00007F5244B935A6h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B3FD9 second address: 9B3FDD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B3FDD second address: 9B3FFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F5244B935B7h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B3FFE second address: 9B4025 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5245261504h 0x00000007 jmp 00007F52452614FFh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B4025 second address: 9B402B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B673C second address: 9B6740 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BC20C second address: 9BC212 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BC485 second address: 9BC489 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BC489 second address: 9BC49A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [eax] 0x00000008 jbe 00007F5244B935AEh 0x0000000e push ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C389D second address: 9C38A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C2CB2 second address: 9C2CE1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5244B935B6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F5244B935B5h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C2CE1 second address: 9C2CE6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C3421 second address: 9C345D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F5244B935A6h 0x0000000a pushad 0x0000000b jmp 00007F5244B935B9h 0x00000010 jmp 00007F5244B935B6h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C345D second address: 9C3482 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F5245261506h 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e jng 00007F52452614F6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C35B5 second address: 9C35BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C97C9 second address: 9C97CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C9BF8 second address: 9C9C09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jne 00007F5244B935A6h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C9C09 second address: 9C9C0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C9C0F second address: 9C9C13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C9C13 second address: 9C9C17 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C9D4C second address: 9C9D50 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C9D50 second address: 9C9D5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F52452614F8h 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C9D5E second address: 9C9D76 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pushad 0x00000007 jnp 00007F5244B935A6h 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f push esi 0x00000010 pop esi 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 pushad 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C9D76 second address: 9C9D87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C9D87 second address: 9C9D8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C9D8B second address: 9C9D91 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CA1DD second address: 9CA1E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CA1E5 second address: 9CA1EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CA1EC second address: 9CA1F6 instructions: 0x00000000 rdtsc 0x00000002 js 00007F5244B935ACh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CDCE0 second address: 9CDCE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CDCE8 second address: 9CDCF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CDCF0 second address: 9CDCF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CDCF5 second address: 9CDD3D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5244B935B5h 0x00000007 pushad 0x00000008 jmp 00007F5244B935B2h 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007F5244B935B5h 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 pushad 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98F87E second address: 98F8A3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5245261509h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push edi 0x0000000e pop edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98F8A3 second address: 98F8A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98F8A8 second address: 98F8BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5245261502h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98FD75 second address: 98FD94 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5244B935ABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F5244B935ADh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98FD94 second address: 98FD9E instructions: 0x00000000 rdtsc 0x00000002 je 00007F52452614FCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 990081 second address: 990085 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 990085 second address: 99008B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99008B second address: 99009A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5244B935ABh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99049B second address: 9904A5 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F52452614FCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9904A5 second address: 99051E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push esi 0x0000000c call 00007F5244B935A8h 0x00000011 pop esi 0x00000012 mov dword ptr [esp+04h], esi 0x00000016 add dword ptr [esp+04h], 00000018h 0x0000001e inc esi 0x0000001f push esi 0x00000020 ret 0x00000021 pop esi 0x00000022 ret 0x00000023 xor edx, 5DB76A45h 0x00000029 mov ecx, dword ptr [ebp+122D2DE6h] 0x0000002f push 00000004h 0x00000031 push 00000000h 0x00000033 push edi 0x00000034 call 00007F5244B935A8h 0x00000039 pop edi 0x0000003a mov dword ptr [esp+04h], edi 0x0000003e add dword ptr [esp+04h], 0000001Dh 0x00000046 inc edi 0x00000047 push edi 0x00000048 ret 0x00000049 pop edi 0x0000004a ret 0x0000004b mov edx, dword ptr [ebp+122D2656h] 0x00000051 call 00007F5244B935AAh 0x00000056 add dword ptr [ebp+122D1DC2h], esi 0x0000005c pop edi 0x0000005d nop 0x0000005e push eax 0x0000005f push edx 0x00000060 push eax 0x00000061 push eax 0x00000062 push edx 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99051E second address: 990523 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9908AE second address: 9908BF instructions: 0x00000000 rdtsc 0x00000002 jp 00007F5244B935A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e push edi 0x0000000f pop edi 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9908BF second address: 9908C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 990B8B second address: 978B35 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 jmp 00007F5244B935ADh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esp], eax 0x00000010 push 00000000h 0x00000012 push edx 0x00000013 call 00007F5244B935A8h 0x00000018 pop edx 0x00000019 mov dword ptr [esp+04h], edx 0x0000001d add dword ptr [esp+04h], 00000019h 0x00000025 inc edx 0x00000026 push edx 0x00000027 ret 0x00000028 pop edx 0x00000029 ret 0x0000002a pushad 0x0000002b sub ebx, dword ptr [ebp+122D298Fh] 0x00000031 jbe 00007F5244B935ABh 0x00000037 popad 0x00000038 lea eax, dword ptr [ebp+1246F614h] 0x0000003e push 00000000h 0x00000040 push ebp 0x00000041 call 00007F5244B935A8h 0x00000046 pop ebp 0x00000047 mov dword ptr [esp+04h], ebp 0x0000004b add dword ptr [esp+04h], 0000001Ah 0x00000053 inc ebp 0x00000054 push ebp 0x00000055 ret 0x00000056 pop ebp 0x00000057 ret 0x00000058 push eax 0x00000059 jng 00007F5244B935B4h 0x0000005f jmp 00007F5244B935AEh 0x00000064 mov dword ptr [esp], eax 0x00000067 mov edx, 6386A5F3h 0x0000006c call dword ptr [ebp+12447CF3h] 0x00000072 push ebx 0x00000073 jmp 00007F5244B935B0h 0x00000078 je 00007F5244B935AEh 0x0000007e push ebx 0x0000007f pop ebx 0x00000080 push eax 0x00000081 push edx 0x00000082 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 978B35 second address: 978B43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jng 00007F5245261506h 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CE049 second address: 9CE081 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F5244B935A6h 0x00000008 jmp 00007F5244B935AFh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop ebx 0x00000010 jo 00007F5244B935DAh 0x00000016 pushad 0x00000017 jmp 00007F5244B935B5h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CE1C4 second address: 9CE1CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CE1CA second address: 9CE20F instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F5244B935A6h 0x00000008 jmp 00007F5244B935AEh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jmp 00007F5244B935B1h 0x00000015 jmp 00007F5244B935AEh 0x0000001a pushad 0x0000001b popad 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f je 00007F5244B935A6h 0x00000025 pushad 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CE20F second address: 9CE213 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CE37C second address: 9CE387 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CE387 second address: 9CE38B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CE38B second address: 9CE38F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CE66C second address: 9CE687 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F52452614FDh 0x00000007 jns 00007F52452614F6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CE687 second address: 9CE68B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CE68B second address: 9CE69B instructions: 0x00000000 rdtsc 0x00000002 ja 00007F52452614F6h 0x00000008 jnc 00007F52452614F6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CE69B second address: 9CE6A0 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CE6A0 second address: 9CE6B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edi 0x00000007 pushad 0x00000008 jns 00007F52452614F6h 0x0000000e jns 00007F52452614F6h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CE82A second address: 9CE82E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CE82E second address: 9CE866 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F5245261505h 0x0000000f jmp 00007F5245261509h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CE866 second address: 9CE880 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5244B935B6h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CEB42 second address: 9CEB46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CEB46 second address: 9CEB4F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D257E second address: 9D2588 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F52452614F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D7D14 second address: 9D7D1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D7D1A second address: 9D7D4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F5245261507h 0x0000000b jmp 00007F5245261505h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D7D4E second address: 9D7D93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5244B935B4h 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e jng 00007F5244B935A6h 0x00000014 jmp 00007F5244B935B3h 0x00000019 pop esi 0x0000001a jmp 00007F5244B935AEh 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D6A8C second address: 9D6AB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F52452614F6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F5245261505h 0x00000012 jc 00007F52452614F6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D6AB4 second address: 9D6AB8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D6AB8 second address: 9D6ABE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D6ABE second address: 9D6AD1 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F5244B935AAh 0x00000008 push eax 0x00000009 pop eax 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c pushad 0x0000000d push edx 0x0000000e pop edx 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D6C0F second address: 9D6C1B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jl 00007F52452614F6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D6D4B second address: 9D6D4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D6D4F second address: 9D6D70 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F52452614FDh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jc 00007F52452614FEh 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 ja 00007F52452614F6h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D6D70 second address: 9D6D75 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D6D75 second address: 9D6D83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jp 00007F52452614F6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D6D83 second address: 9D6D90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jg 00007F5244B935A6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D708A second address: 9D708E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D67E1 second address: 9D67E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D67E5 second address: 9D67F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jne 00007F52452614F6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D75AF second address: 9D75C9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jp 00007F5244B935ACh 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D75C9 second address: 9D75CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D75CF second address: 9D75D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D7A39 second address: 9D7A45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F52452614F6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DE10F second address: 9DE115 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DE559 second address: 9DE567 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F52452614FAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E0B60 second address: 9E0B8E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007F5244B935BEh 0x0000000c jmp 00007F5244B935B8h 0x00000011 pop edx 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 jg 00007F5244B935A6h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E0B8E second address: 9E0B92 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E754B second address: 9E7550 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E76A5 second address: 9E76A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E7AD4 second address: 9E7AE4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007F5244B935A6h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E7AE4 second address: 9E7AEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F52452614F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E8551 second address: 9E8555 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E8555 second address: 9E8567 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F52452614F6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E8567 second address: 9E856B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EC8FB second address: 9EC92E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 jmp 00007F5245261504h 0x0000000e jmp 00007F5245261504h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EC92E second address: 9EC946 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 js 00007F5244B935AEh 0x0000000b push ebx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EBB4D second address: 9EBB58 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EBB58 second address: 9EBB5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EBB5F second address: 9EBB96 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F52452614FAh 0x00000008 jmp 00007F5245261505h 0x0000000d push edx 0x0000000e pop edx 0x0000000f popad 0x00000010 push edx 0x00000011 jnl 00007F52452614F6h 0x00000017 pop edx 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f pop eax 0x00000020 push ebx 0x00000021 pop ebx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EBB96 second address: 9EBBB8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5244B935B8h 0x00000007 js 00007F5244B935A6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EC19F second address: 9EC1B6 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F52452614F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F52452614FDh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EC1B6 second address: 9EC1BD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EC302 second address: 9EC30F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jp 00007F52452614FEh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EC30F second address: 9EC333 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jbe 00007F5244B935A6h 0x0000000e jmp 00007F5244B935B6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EC333 second address: 9EC339 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EC497 second address: 9EC49D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EC49D second address: 9EC4A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EF96C second address: 9EF97F instructions: 0x00000000 rdtsc 0x00000002 jne 00007F5244B935A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jne 00007F5244B935A6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EF97F second address: 9EF987 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EF987 second address: 9EF99A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push ebx 0x00000006 jmp 00007F5244B935ABh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F60A3 second address: 9F60BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5245261504h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F60BB second address: 9F60C1 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F6398 second address: 9F639D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F6668 second address: 9F6690 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jl 00007F5244B935A6h 0x0000000c popad 0x0000000d pushad 0x0000000e jmp 00007F5244B935B6h 0x00000013 push edi 0x00000014 pop edi 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F6690 second address: 9F6698 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F6698 second address: 9F66AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jmp 00007F5244B935ADh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F66AD second address: 9F66BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jng 00007F52452614FEh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F6A30 second address: 9F6A49 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5244B935B2h 0x00000007 pushad 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F6CF1 second address: 9F6D0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F52452614FAh 0x0000000a popad 0x0000000b jc 00007F5245261508h 0x00000011 push eax 0x00000012 push edx 0x00000013 ja 00007F52452614F6h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FC2DB second address: 9FC2E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FC2E1 second address: 9FC2E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FC2E7 second address: 9FC305 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jns 00007F5244B935B2h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FC305 second address: 9FC30B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FC30B second address: 9FC319 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F5244B935A8h 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FB4AE second address: 9FB4B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FB4B2 second address: 9FB4CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5244B935B7h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FB4CF second address: 9FB4D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FB6D8 second address: 9FB6E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5244B935AAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FB6E6 second address: 9FB6F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 jne 00007F52452614F6h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FBB3E second address: 9FBB7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a jl 00007F5244B935A6h 0x00000010 jmp 00007F5244B935B6h 0x00000015 popad 0x00000016 push ebx 0x00000017 pushad 0x00000018 popad 0x00000019 pop ebx 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F5244B935AEh 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FBD3B second address: 9FBD3F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FBFD1 second address: 9FBFF3 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F5244B935A6h 0x00000008 jmp 00007F5244B935B8h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A03B02 second address: A03B0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A03B0A second address: A03B15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A03B15 second address: A03B19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0A15B second address: A0A174 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5244B935B5h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0A2CB second address: A0A2D9 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 jc 00007F52452614F6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0A561 second address: A0A581 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F5244B935A8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b jmp 00007F5244B935B0h 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0A581 second address: A0A587 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0A6C2 second address: A0A6F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F5244B935A6h 0x0000000a pop edx 0x0000000b pushad 0x0000000c jmp 00007F5244B935B5h 0x00000011 jmp 00007F5244B935ACh 0x00000016 push ebx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0A6F2 second address: A0A700 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F52452614F6h 0x0000000a pop ebx 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0A957 second address: A0A960 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0A960 second address: A0A9A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007F52452614F6h 0x00000009 push edx 0x0000000a pop edx 0x0000000b jmp 00007F5245261508h 0x00000010 popad 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pushad 0x00000014 pushad 0x00000015 jmp 00007F5245261504h 0x0000001a jne 00007F52452614F6h 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0AADE second address: A0AAE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A098EC second address: A098F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F52452614F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A098F6 second address: A09907 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 js 00007F5244B935A6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A09907 second address: A0990D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0990D second address: A09912 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0DD3B second address: A0DD4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 jne 00007F52452614F6h 0x0000000c pop ecx 0x0000000d push edi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A10DCB second address: A10DD2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A15A4E second address: A15A54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A26D24 second address: A26D2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A268CD second address: A268E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F5245261502h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A26A2C second address: A26A31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2926E second address: A29281 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 jbe 00007F52452614FCh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A29281 second address: A29286 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2E485 second address: A2E496 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F52452614F6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2E496 second address: A2E4A2 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F5244B935A6h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2E4A2 second address: A2E4AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2E4AA second address: A2E4C6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jo 00007F5244B935A8h 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 push eax 0x00000014 ja 00007F5244B935A6h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2E4C6 second address: A2E4D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jl 00007F52452614F6h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2E4D5 second address: A2E4DB instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3AFA7 second address: A3AFAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3AFAC second address: A3AFB8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F5244B935A6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3AFB8 second address: A3AFBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3AFBC second address: A3AFC0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A41B7B second address: A41B9D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F52452614FAh 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F52452614FCh 0x00000010 ja 00007F52452614F6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4214B second address: A42164 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F5244B935A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b jmp 00007F5244B935ABh 0x00000010 pushad 0x00000011 popad 0x00000012 pop edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A422DF second address: A422F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F52452614FEh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A422F3 second address: A422FD instructions: 0x00000000 rdtsc 0x00000002 js 00007F5244B935A6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A42436 second address: A4243A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4243A second address: A42440 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A42DAE second address: A42DD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push eax 0x00000007 pop eax 0x00000008 jns 00007F52452614F6h 0x0000000e jmp 00007F5245261506h 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A47692 second address: A47698 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A47698 second address: A476A2 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F52452614F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A477D1 second address: A477D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A477D7 second address: A477FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push edi 0x00000008 jmp 00007F5245261504h 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5678D second address: A5679B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F5244B935A6h 0x0000000a pop edi 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A513D7 second address: A513DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6620D second address: A66213 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A66213 second address: A66218 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A66218 second address: A6622E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5244B935B0h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6622E second address: A66238 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F52452614F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7E040 second address: A7E045 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7E045 second address: A7E04B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7E04B second address: A7E078 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push esi 0x00000007 pop esi 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e push eax 0x0000000f pop eax 0x00000010 pop ecx 0x00000011 pushad 0x00000012 jl 00007F5244B935A6h 0x00000018 jmp 00007F5244B935B2h 0x0000001d pushad 0x0000001e popad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7E078 second address: A7E0A6 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F5245261518h 0x00000008 jmp 00007F5245261507h 0x0000000d jmp 00007F52452614FBh 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7E4C8 second address: A7E50F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5244B935B9h 0x00000009 jl 00007F5244B935A6h 0x0000000f popad 0x00000010 jmp 00007F5244B935AAh 0x00000015 pop ebx 0x00000016 push eax 0x00000017 push edx 0x00000018 jl 00007F5244B935A8h 0x0000001e push esi 0x0000001f pop esi 0x00000020 jno 00007F5244B935AEh 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7EC25 second address: A7EC38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 jne 00007F52452614F6h 0x0000000c pop edi 0x0000000d pop edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7EC38 second address: A7EC3E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7EC3E second address: A7EC48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7EC48 second address: A7EC4C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A81BAF second address: A81BB5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A81BB5 second address: A81BB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A81E0D second address: A81E17 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F52452614F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A81EAA second address: A81EAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A81EAE second address: A81EB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A81EB2 second address: A81EB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A81EB8 second address: A81EDD instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F52452614F8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c jng 00007F5245261504h 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A81EDD second address: A81F1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F5244B935A6h 0x0000000a popad 0x0000000b popad 0x0000000c nop 0x0000000d mov dword ptr [ebp+1246A879h], ecx 0x00000013 push 00000004h 0x00000015 jmp 00007F5244B935B5h 0x0000001a push F35289FEh 0x0000001f pushad 0x00000020 jnl 00007F5244B935ACh 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A81F1D second address: A81F21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A85227 second address: A8522D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8522D second address: A8524B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F52452614F6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F52452614FFh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8524B second address: A8524F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8524F second address: A85253 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A85253 second address: A85259 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A86E42 second address: A86E5A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jo 00007F52452614F6h 0x00000009 ja 00007F52452614F6h 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 js 00007F52452614F6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A86E5A second address: A86E5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C0D67 second address: 51C0DB4 instructions: 0x00000000 rdtsc 0x00000002 mov bx, ax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 test ecx, ecx 0x0000000a jmp 00007F5245261502h 0x0000000f jns 00007F524526153Eh 0x00000015 jmp 00007F5245261500h 0x0000001a add eax, ecx 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F5245261507h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C0DB4 second address: 51C0DEC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5244B935B9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax+00000860h] 0x0000000f jmp 00007F5244B935AEh 0x00000014 test eax, eax 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a pop edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C0DEC second address: 51C0E39 instructions: 0x00000000 rdtsc 0x00000002 mov ecx, 5E4A8A8Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushfd 0x0000000a jmp 00007F5245261504h 0x0000000f and si, 0E38h 0x00000014 jmp 00007F52452614FBh 0x00000019 popfd 0x0000001a popad 0x0000001b je 00007F52B69D7439h 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007F5245261505h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C0E39 second address: 51C0E49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5244B935ACh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 993F60 second address: 993F67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 993F67 second address: 993F71 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F5244B935ACh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 7F3B3B instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 98660B instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 9869A3 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 98524E instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 98FA46 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: A1D4D8 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe TID: 2496

Thread sleep time: -30000s >= -30000s

Jump to behavior

Source: file.exe	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe	Binary or memory string: E0\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: file.exe, 00000000.00000003.2170794589.0000000001361000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2175546958.00000000012DE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2175755698.0000000001361000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.2175546958.0000000001334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWL
Source: file.exe, 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_007D5BB0 LdrInitializeThunk,

0_2_007D5BB0

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: file.exe	String found in binary or memory: clearancek.site
Source: file.exe	String found in binary or memory: licendfilteo.site
Source: file.exe	String found in binary or memory: spirittunek.store
Source: file.exe	String found in binary or memory: bathdoomgaz.store
Source: file.exe	String found in binary or memory: studennotediw.store
Source: file.exe	String found in binary or memory: dissapoiznw.store
Source: file.exe	String found in binary or memory: eaglepawnoy.store
Source: file.exe	String found in binary or memory: mobbipenju.store

Source: file.exe, file.exe, 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: WProgram Manager

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Process Injection	24 Virtualization/Sandbox Evasion	OS Credential Dumping	631 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	LSASS Memory	24 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	4 Obfuscated Files or Information	NTDS	23 System Information Discovery	Distributed Component Object Model	Input Capture	113 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://player.vimeo.com	0%	URL Reputation	safe
https://help.steampowered.com/en/	0%	URL Reputation	safe
https://store.steampowered.com/news/	0%	URL Reputation	safe
https://store.steampowered.com/subscriber_agreement/	0%	URL Reputation	safe
https://www.gstatic.cn/recaptcha/	0%	URL Reputation	safe
http://store.steampowered.com/subscriber_agreement/	0%	URL Reputation	safe
https://recaptcha.net/recaptcha/;	0%	URL Reputation	safe
http://www.valvesoftware.com/legal.htm	0%	URL Reputation	safe
https://store.steampowered.com/stats/	0%	URL Reputation	safe
https://medal.tv	0%	URL Reputation	safe
https://broadcast.st.dl.eccdnx.com	0%	URL Reputation	safe
https://store.steampowered.com/steam_refunds/	0%	URL Reputation	safe
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	0%	URL Reputation	safe
https://login.steampowered.com/	0%	URL Reputation	safe
https://store.steampowered.com/legal/	0%	URL Reputation	safe
https://steam.tv/	0%	URL Reputation	safe
http://store.steampowered.com/privacy_agreement/	0%	URL Reputation	safe
https://steamcommunity.com:443/profiles/76561199724331900	100%	URL Reputation	malware
https://store.steampowered.com/points/shop/	0%	URL Reputation	safe
https://recaptcha.net	0%	URL Reputation	safe
https://store.steampowered.com/	0%	URL Reputation	safe
https://lv.queniujq.cn	0%	URL Reputation	safe
https://store.steampowered.com/privacy_agreement/	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	0%	URL Reputation	safe
https://checkout.steampowered.com/	0%	URL Reputation	safe
https://help.steampowered.com/	0%	URL Reputation	safe
https://api.steampowered.com/	0%	URL Reputation	safe
http://store.steampowered.com/account/cookiepreferences/	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_logo.png	0%	URL Reputation	safe
https://store.steampowered.com/mobile	0%	URL Reputation	safe
https://store.steampowered.com/;	0%	URL Reputation	safe
https://store.steampowered.com/about/	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
steamcommunity.com	104.102.49.254	true	true	unknown
eaglepawnoy.store	unknown	unknown	true	unknown
bathdoomgaz.store	unknown	unknown	true	unknown
spirittunek.store	unknown	unknown	true	unknown
licendfilteo.site	unknown	unknown	true	unknown
studennotediw.store	unknown	unknown	true	unknown
mobbipenju.store	unknown	unknown	true	unknown
clearancek.site	unknown	unknown	true	unknown
dissapoiznw.store	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Reputation
bathdoomgaz.store	true	unknown
studennotediw.store	true	unknown
clearancek.site	true	unknown
dissapoiznw.store	true	unknown
https://steamcommunity.com/profiles/76561199724331900	true	unknown
spirittunek.store	true	unknown
licendfilteo.site	true	unknown
eaglepawnoy.store	true	unknown
mobbipenju.store	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://steamcommunity.com/my/wishlist/	file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://player.vimeo.com	file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2175755698.0000000001369000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC&	file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170949966.00000000013A1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://bathdoomgaz.store:443/api	file.exe, 00000000.00000002.2175546958.000000000131E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/?subsection=broadcasts	file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://help.steampowered.com/en/	file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_global.js?v=wJD9maDpDcV	file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170949966.00000000013A1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/market/	file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/news/	file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/subscriber_agreement/	file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.gstatic.cn/recaptcha/	file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2175755698.0000000001369000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://store.steampowered.com/subscriber_agreement/	file.exe, 00000000.00000003.2170794589.0000000001355000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2175835083.00000000013A2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170949966.00000000013A1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/applications/community/manifest.js?v=	file.exe, 00000000.00000002.2175835083.00000000013A2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2175546958.0000000001334000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170949966.00000000013A1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	file.exe, 00000000.00000003.2170794589.0000000001355000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2175835083.00000000013A2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170949966.00000000013A1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/css/applications/community/main.css?v=ljhW-PbGuX	file.exe, 00000000.00000002.2175835083.00000000013A2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2175546958.0000000001334000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170949966.00000000013A1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://recaptcha.net/recaptcha/;	file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2175755698.0000000001369000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpE	file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170949966.00000000013A1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://dissapoiznw.store:443/api	file.exe, 00000000.00000002.2175546958.000000000131E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.valvesoftware.com/legal.htm	file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/discussions/	file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.youtube.com	file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2175755698.0000000001369000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.google.com	file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2175755698.0000000001369000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/stats/	file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/global.js?v=bOP7RorZq4_W&l=englis	file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170949966.00000000013A1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://medal.tv	file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2175755698.0000000001369000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://broadcast.st.dl.eccdnx.com	file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2175755698.0000000001369000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0&amp	file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170949966.00000000013A1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/steam_refunds/	file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v	file.exe, 00000000.00000002.2175835083.00000000013A2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170949966.00000000013A1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.p	file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	file.exe, 00000000.00000003.2170794589.0000000001355000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2175835083.00000000013A2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170949966.00000000013A1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900	file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170949966.00000000013A1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1	file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170949966.00000000013A1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://s.ytimg.com;	file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2175755698.0000000001369000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/workshop/	file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://login.steampowered.com/	file.exe, 00000000.00000002.2175755698.0000000001369000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/legal/	file.exe, 00000000.00000003.2170794589.0000000001355000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2175835083.00000000013A2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170949966.00000000013A1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steam.tv/	file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2175755698.0000000001369000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://licendfilteo.site:443/api	file.exe, 00000000.00000002.2175546958.000000000131E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/css/buttons.css?v=tuNiaSwXwcYT&l=engl	file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170949966.00000000013A1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/css/motiva_sans.css?v=GfSjbGKcNYaQ&l=	file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170949966.00000000013A1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/javascript/applications/community/main.js?v=W9BX	file.exe, 00000000.00000002.2175835083.00000000013A2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2175546958.0000000001334000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170949966.00000000013A1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw&	file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170949966.00000000013A1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/css/globalv2.css?v=pwVcIAtHNXwg&l=english&am	file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170949966.00000000013A1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://store.steampowered.com/privacy_agreement/	file.exe, 00000000.00000003.2170794589.0000000001355000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2175835083.00000000013A2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170949966.00000000013A1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/css/shared_responsive.css?v=eghn9DNyCY67&	file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170949966.00000000013A1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com:443/profiles/76561199724331900	file.exe, 00000000.00000002.2175546958.000000000131E000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
https://community.cloudflare.steamstatic.com/public/css/skin_1/header.css?v=vh4BMeDcNiCU&l=engli	file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170949966.00000000013A1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/points/shop/	file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://recaptcha.net	file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2175755698.0000000001369000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/	file.exe, 00000000.00000002.2175755698.0000000001369000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/css/skin_1/fatalerror.css?v=wctRWaBvNt2z&l=e	file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170949966.00000000013A1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com	file.exe, 00000000.00000002.2175835083.00000000013A2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2175546958.0000000001334000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170949966.00000000013A1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/css/shared_global.css?v=Ff_1prscqzeu&	file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170949966.00000000013A1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://sketchfab.com	file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2175755698.0000000001369000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://lv.queniujq.cn	file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2175755698.0000000001369000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://mobbipenju.store:443/api	file.exe, 00000000.00000002.2175546958.000000000131E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.youtube.com/	file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2175755698.0000000001369000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://127.0.0.1:27060	file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2175755698.0000000001369000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/privacy_agreement/	file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/	file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2175755698.0000000001369000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	file.exe, 00000000.00000002.2175835083.00000000013A2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170949966.00000000013A1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://spirittunek.store:443/api	file.exe, 00000000.00000002.2175546958.000000000131E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/recaptcha/	file.exe, 00000000.00000002.2175755698.0000000001369000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://checkout.steampowered.com/	file.exe, 00000000.00000002.2175755698.0000000001369000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://help.steampowered.com/	file.exe, 00000000.00000002.2175755698.0000000001369000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.steampowered.com/	file.exe, 00000000.00000002.2175755698.0000000001369000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://studennotediw.store:443/api6	file.exe, 00000000.00000002.2175546958.000000000131E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/javascript/applications/community/libraries~b28b	file.exe, 00000000.00000002.2175835083.00000000013A2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2175546958.0000000001334000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170949966.00000000013A1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://store.steampowered.com/account/cookiepreferences/	file.exe, 00000000.00000003.2170794589.0000000001355000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2175835083.00000000013A2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170949966.00000000013A1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_logo.png	file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/mobile	file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/	file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2175546958.0000000001313000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2175755698.0000000001369000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/;	file.exe, 00000000.00000003.2170794589.0000000001369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2175755698.0000000001369000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://clearancek.site:443/apip	file.exe, 00000000.00000002.2175546958.000000000131E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/about/	file.exe, 00000000.00000003.2170774912.00000000013A7000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/	file.exe, 00000000.00000002.2175755698.0000000001369000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.102.49.254	steamcommunity.com	United States		16625	AKAMAI-ASUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1541197
Start date and time:	2024-10-24 15:08:11 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 41s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	2
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@9/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, otelrules.azureedge.net
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
09:09:07	API Interceptor	3x Sleep call for process: file.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.102.49.254	http://gtm-cn-j4g3qqvf603.steamproxy1.com/	Get hash	malicious	Unknown	Browse	www.valvesoftware.com/legal.htm

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
steamcommunity.com	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.102.49.254
	g4Cyr2T5jq.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse	104.102.49.254
	hAyQbTcI0I.exe	Get hash	malicious	Socks5Systemz	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, Stealc	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.102.49.254

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASUS	From.S03E06.1080p.WEB.H264-SuccessfulCrab.mkv.zip	Get hash	malicious	Xmrig	Browse	184.28.89.167
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	https://1drv.ms/o/c/3e563d3fb2a98d1c/Emlo5KUbYYNEvKtIF-7SS0EBYSeT3hOOGuv_MbeT-n2y4g?e=HPjqUn	Get hash	malicious	HtmlDropper	Browse	184.28.89.164
	attachment(1).eml	Get hash	malicious	Unknown	Browse	184.28.90.27
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	gNubpp8EFH.elf	Get hash	malicious	Mirai	Browse	95.101.248.49
	atH4SE3Oi6.elf	Get hash	malicious	Mirai	Browse	23.199.141.126
	o2YUBeMZW6.elf	Get hash	malicious	Mirai	Browse	95.101.248.46
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.102.49.254

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	StudioDemo.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	5Setup.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	PO%20K22012FA[1].docx	Get hash	malicious	Unknown	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	https://is.gd/6NgVrQ	Get hash	malicious	HTMLPhisher	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.102.49.254

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.536242690815119
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'921'984 bytes
MD5:	83358e80d76d88ca2a9b071c0b0125d8
SHA1:	df938b308f8d3ba4374d5e6cb9e3052e1a785d70
SHA256:	360de1bff31fd900b6a8c06f9041f0276e3a3aaf4a882c816ecae09fbb13bbfe
SHA512:	3d72a2956b6e1b2d02356bf6a91cf72e24d45e3e210a4159c73689e19abe3caa12ae320dcf83cbb8f355f8cae5f8b68df8084136dc36e5378b1de642672c31a6
SSDEEP:	49152:6ZRG50b/RzqQRsPpLy8sl2DS7BCVy14i:6rG50b/ReosPpLSlv7BM
TLSH:	4DD54B92B51971EBD84F2778982FCD816A5D83F90B3104C3AC69A8F96D73DC121B7D28
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...J..f..............................0...........@..........................@0......t-...@.................................W...k..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x701000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66FFF14A [Fri Oct 4 13:44:42 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F52451730CAh
pcmpeqb mm5, qword ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F52451750C5h
add byte ptr [edi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx+ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or byte ptr [eax+00000000h], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
inc eax
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax*4], cl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5f057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x5f1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x5d000	0x25e00	a946b8401100d07657c92a4e733a7856	False	0.9994520936468647	data	7.977968387175993	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x5e000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x5f000	0x1000	0x200	fe72def8b74193a84232a780098a7ce0	False	0.150390625	data	1.04205214219471	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
qgwqnumb	0x60000	0x2a0000	0x2a0000	2c870cf6a5f2eb8147931af3ce8609ec	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
texvacgq	0x300000	0x1000	0x400	999071be04a8043438154422f53919cf	False	0.7373046875	data	5.910928274433419	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x301000	0x3000	0x2200	10e8ae75316750d28b25abf2d0301628	False	0.060317095588235295	DOS executable (COM)	0.7658784467866113	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-24T15:09:08.270599+0200	2056471	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)	1	192.168.2.6	62145	1.1.1.1	53	UDP
2024-10-24T15:09:08.290387+0200	2056485	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)	1	192.168.2.6	56907	1.1.1.1	53	UDP
2024-10-24T15:09:08.314361+0200	2056483	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)	1	192.168.2.6	63671	1.1.1.1	53	UDP
2024-10-24T15:09:08.329193+0200	2056481	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)	1	192.168.2.6	57697	1.1.1.1	53	UDP
2024-10-24T15:09:08.342608+0200	2056479	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)	1	192.168.2.6	62219	1.1.1.1	53	UDP
2024-10-24T15:09:08.355879+0200	2056477	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)	1	192.168.2.6	60356	1.1.1.1	53	UDP
2024-10-24T15:09:08.368088+0200	2056475	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)	1	192.168.2.6	55191	1.1.1.1	53	UDP
2024-10-24T15:09:08.378731+0200	2056473	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)	1	192.168.2.6	57448	1.1.1.1	53	UDP
2024-10-24T15:09:09.948537+0200	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.6	49708	104.102.49.254	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 24, 2024 15:09:08.408056021 CEST	49708	443	192.168.2.6	104.102.49.254
Oct 24, 2024 15:09:08.408103943 CEST	443	49708	104.102.49.254	192.168.2.6
Oct 24, 2024 15:09:08.408252954 CEST	49708	443	192.168.2.6	104.102.49.254
Oct 24, 2024 15:09:08.411642075 CEST	49708	443	192.168.2.6	104.102.49.254
Oct 24, 2024 15:09:08.411655903 CEST	443	49708	104.102.49.254	192.168.2.6
Oct 24, 2024 15:09:09.261378050 CEST	443	49708	104.102.49.254	192.168.2.6
Oct 24, 2024 15:09:09.261465073 CEST	49708	443	192.168.2.6	104.102.49.254
Oct 24, 2024 15:09:09.265683889 CEST	49708	443	192.168.2.6	104.102.49.254
Oct 24, 2024 15:09:09.265711069 CEST	443	49708	104.102.49.254	192.168.2.6
Oct 24, 2024 15:09:09.266177893 CEST	443	49708	104.102.49.254	192.168.2.6
Oct 24, 2024 15:09:09.320358038 CEST	49708	443	192.168.2.6	104.102.49.254
Oct 24, 2024 15:09:09.333967924 CEST	49708	443	192.168.2.6	104.102.49.254
Oct 24, 2024 15:09:09.375329018 CEST	443	49708	104.102.49.254	192.168.2.6
Oct 24, 2024 15:09:09.948587894 CEST	443	49708	104.102.49.254	192.168.2.6
Oct 24, 2024 15:09:09.948610067 CEST	443	49708	104.102.49.254	192.168.2.6
Oct 24, 2024 15:09:09.948620081 CEST	443	49708	104.102.49.254	192.168.2.6
Oct 24, 2024 15:09:09.948633909 CEST	443	49708	104.102.49.254	192.168.2.6
Oct 24, 2024 15:09:09.948664904 CEST	443	49708	104.102.49.254	192.168.2.6
Oct 24, 2024 15:09:09.948755980 CEST	49708	443	192.168.2.6	104.102.49.254
Oct 24, 2024 15:09:09.948755980 CEST	49708	443	192.168.2.6	104.102.49.254
Oct 24, 2024 15:09:09.948772907 CEST	443	49708	104.102.49.254	192.168.2.6
Oct 24, 2024 15:09:09.948920965 CEST	49708	443	192.168.2.6	104.102.49.254
Oct 24, 2024 15:09:09.954673052 CEST	443	49708	104.102.49.254	192.168.2.6
Oct 24, 2024 15:09:09.954727888 CEST	443	49708	104.102.49.254	192.168.2.6
Oct 24, 2024 15:09:09.954922915 CEST	443	49708	104.102.49.254	192.168.2.6
Oct 24, 2024 15:09:09.955187082 CEST	49708	443	192.168.2.6	104.102.49.254
Oct 24, 2024 15:09:09.955187082 CEST	49708	443	192.168.2.6	104.102.49.254
Oct 24, 2024 15:09:09.956532955 CEST	49708	443	192.168.2.6	104.102.49.254
Oct 24, 2024 15:09:09.956552029 CEST	443	49708	104.102.49.254	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 24, 2024 15:09:08.270598888 CEST	62145	53	192.168.2.6	1.1.1.1
Oct 24, 2024 15:09:08.280440092 CEST	53	62145	1.1.1.1	192.168.2.6
Oct 24, 2024 15:09:08.290386915 CEST	56907	53	192.168.2.6	1.1.1.1
Oct 24, 2024 15:09:08.299458027 CEST	53	56907	1.1.1.1	192.168.2.6
Oct 24, 2024 15:09:08.314361095 CEST	63671	53	192.168.2.6	1.1.1.1
Oct 24, 2024 15:09:08.325231075 CEST	53	63671	1.1.1.1	192.168.2.6
Oct 24, 2024 15:09:08.329193115 CEST	57697	53	192.168.2.6	1.1.1.1
Oct 24, 2024 15:09:08.339310884 CEST	53	57697	1.1.1.1	192.168.2.6
Oct 24, 2024 15:09:08.342607975 CEST	62219	53	192.168.2.6	1.1.1.1
Oct 24, 2024 15:09:08.354549885 CEST	53	62219	1.1.1.1	192.168.2.6
Oct 24, 2024 15:09:08.355879068 CEST	60356	53	192.168.2.6	1.1.1.1
Oct 24, 2024 15:09:08.366651058 CEST	53	60356	1.1.1.1	192.168.2.6
Oct 24, 2024 15:09:08.368088007 CEST	55191	53	192.168.2.6	1.1.1.1
Oct 24, 2024 15:09:08.377490997 CEST	53	55191	1.1.1.1	192.168.2.6
Oct 24, 2024 15:09:08.378731012 CEST	57448	53	192.168.2.6	1.1.1.1
Oct 24, 2024 15:09:08.388925076 CEST	53	57448	1.1.1.1	192.168.2.6
Oct 24, 2024 15:09:08.393898964 CEST	55951	53	192.168.2.6	1.1.1.1
Oct 24, 2024 15:09:08.402960062 CEST	53	55951	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 24, 2024 15:09:08.270598888 CEST	192.168.2.6	1.1.1.1	0xffc5	Standard query (0)	clearancek.site	A (IP address)	IN (0x0001)	false
Oct 24, 2024 15:09:08.290386915 CEST	192.168.2.6	1.1.1.1	0xdeb7	Standard query (0)	mobbipenju.store	A (IP address)	IN (0x0001)	false
Oct 24, 2024 15:09:08.314361095 CEST	192.168.2.6	1.1.1.1	0x4c6c	Standard query (0)	eaglepawnoy.store	A (IP address)	IN (0x0001)	false
Oct 24, 2024 15:09:08.329193115 CEST	192.168.2.6	1.1.1.1	0x5eb0	Standard query (0)	dissapoiznw.store	A (IP address)	IN (0x0001)	false
Oct 24, 2024 15:09:08.342607975 CEST	192.168.2.6	1.1.1.1	0xa91b	Standard query (0)	studennotediw.store	A (IP address)	IN (0x0001)	false
Oct 24, 2024 15:09:08.355879068 CEST	192.168.2.6	1.1.1.1	0x22c8	Standard query (0)	bathdoomgaz.store	A (IP address)	IN (0x0001)	false
Oct 24, 2024 15:09:08.368088007 CEST	192.168.2.6	1.1.1.1	0x99b7	Standard query (0)	spirittunek.store	A (IP address)	IN (0x0001)	false
Oct 24, 2024 15:09:08.378731012 CEST	192.168.2.6	1.1.1.1	0xe524	Standard query (0)	licendfilteo.site	A (IP address)	IN (0x0001)	false
Oct 24, 2024 15:09:08.393898964 CEST	192.168.2.6	1.1.1.1	0xa261	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 24, 2024 15:09:08.280440092 CEST	1.1.1.1	192.168.2.6	0xffc5	Name error (3)	clearancek.site	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 15:09:08.299458027 CEST	1.1.1.1	192.168.2.6	0xdeb7	Name error (3)	mobbipenju.store	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 15:09:08.325231075 CEST	1.1.1.1	192.168.2.6	0x4c6c	Name error (3)	eaglepawnoy.store	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 15:09:08.339310884 CEST	1.1.1.1	192.168.2.6	0x5eb0	Name error (3)	dissapoiznw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 15:09:08.354549885 CEST	1.1.1.1	192.168.2.6	0xa91b	Name error (3)	studennotediw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 15:09:08.366651058 CEST	1.1.1.1	192.168.2.6	0x22c8	Name error (3)	bathdoomgaz.store	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 15:09:08.377490997 CEST	1.1.1.1	192.168.2.6	0x99b7	Name error (3)	spirittunek.store	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 15:09:08.388925076 CEST	1.1.1.1	192.168.2.6	0xe524	Name error (3)	licendfilteo.site	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 15:09:08.402960062 CEST	1.1.1.1	192.168.2.6	0xa261	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49708	104.102.49.254	443	4420	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 13:09:09 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-10-24 13:09:09 UTC	1917	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https:// [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Thu, 24 Oct 2024 13:09:09 GMT Content-Length: 26105 Connection: close Set-Cookie: sessionid=b366cc7ae397d5c925deb79a; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cbcfeb0e5371aba24e9977faccad43253; Path=/; Secure; HttpOnly; SameSite=None
2024-10-24 13:09:09 UTC	14467	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-10-24 13:09:09 UTC	11638	IN	Data Raw: 22 3f 6c 3d 74 63 68 69 6e 65 73 65 22 20 6f 6e 63 6c 69 63 6b 3d 22 43 68 61 6e 67 65 4c 61 6e 67 75 61 67 65 28 20 27 74 63 68 69 6e 65 73 65 27 20 29 3b 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 22 3e e7 b9 81 e9 ab 94 e4 b8 ad e6 96 87 20 28 54 72 61 64 69 74 69 6f 6e 61 6c 20 43 68 69 6e 65 73 65 29 3c 2f 61 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 6d 65 6e 75 5f 69 74 65 6d 20 74 69 67 68 74 22 20 68 72 65 66 3d 22 3f 6c 3d 6a 61 70 61 6e 65 73 65 22 20 6f 6e 63 6c 69 63 6b 3d 22 43 68 61 6e 67 65 4c 61 6e 67 75 61 67 65 28 20 27 6a 61 70 61 6e 65 73 65 27 20 29 3b 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 22 3e e6 97 a5 e6 9c ac e8 aa 9e 20 28 4a Data Ascii: "?l=tchinese" onclick="ChangeLanguage( 'tchinese' ); return false;"> (Traditional Chinese)</a><a class="popup_menu_item tight" href="?l=japanese" onclick="ChangeLanguage( 'japanese' ); return false;"> (J

Target ID:	0
Start time:	09:09:04
Start date:	24/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x790000
File size:	2'921'984 bytes
MD5 hash:	83358E80D76D88CA2A9B071C0B0125D8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	76.7%
Total number of Nodes:	43
Total number of Limit Nodes:	4

Executed Functions

Function 0079FCA0 Relevance: 5.4, Strings: 4, Instructions: 373
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

J|BJ, xrefs: 007A000D
t, xrefs: 0079FCBE
VY^_, xrefs: 0079FDFF
V, xrefs: 0079FEDC

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID: J|BJ$V$VY^_$t
API String ID: 0-3701112211
Opcode ID: 35e442585fed207ba24437a5e5ce39c8e94463fbed4e58bd199579a87a87d9f1
Instruction ID: b70571123386adb7b54c1ad46785027c1b33314bf16c4b79d21ba90306958f4b
Opcode Fuzzy Hash: 35e442585fed207ba24437a5e5ce39c8e94463fbed4e58bd199579a87a87d9f1
Instruction Fuzzy Hash: FBD156755083809BD710DF18D49465FBBE2ABD6B44F288D2CF4C98B252D33ACD09DB92

Function 0079D110 Relevance: 1.7, APIs: 1, Instructions: 168
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(00000000), ref: 0079D2F1

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 45bb3c63574022d34f2cb29e5c0957d91fe315462624fb3f3a0cd0a142f012bf
Instruction ID: f5af216e30ad1bd066263647f71bf69944c11fc13062347806b3687c7fff1332
Opcode Fuzzy Hash: 45bb3c63574022d34f2cb29e5c0957d91fe315462624fb3f3a0cd0a142f012bf
Instruction Fuzzy Hash: CC41357040D380ABCB11BB68E699A2EFBF5AF96745F148C1CE5C497212D33ADC148B67

Function 007D5700 Relevance: 1.6, APIs: 1, Instructions: 69
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlReAllocateHeap.NTDLL(?,00000000,?,?), ref: 007D5784

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: cdcb1ce696f0c0ad01ca8dd227027792cf95c9f3509e4a31d844bfb813547a0f
Instruction ID: 03935120174652e7ec5a3cf2a774ba24ccfd6c0442c952e5fdc8f78b3bade262
Opcode Fuzzy Hash: cdcb1ce696f0c0ad01ca8dd227027792cf95c9f3509e4a31d844bfb813547a0f
Instruction Fuzzy Hash: 5411A07591D280EBD301AF28E844A1BBBF5AF9A711F158829E4C49B311D339D811CB97

Function 007D5BB0 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(007D973D,005C003F,00000006,?,?,00000018,8C8D8A8B,?,?), ref: 007D5BDE

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction ID: fb6f357373f259be8b0e83fffc5d2a3912a28e0da7d2036ce94b71e982b3a7e9
Opcode Fuzzy Hash: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction Fuzzy Hash: 76E0FE75908316AB9A09CF45C14444EFBE5BFC4714F11CC8DA4D867210D3B0AD46DF82

Function 007D695B Relevance: 1.4, Strings: 1, Instructions: 100
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@, xrefs: 007D69C5

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: b664fdd66e8bbff381f4cf3a00aa4c802958b85fecd182ca4623b86febe13bfb
Instruction ID: 1297179b422eddd7ef2e28affa0a328eed8cfb560f935b20710c05a4e8ce0fb8
Opcode Fuzzy Hash: b664fdd66e8bbff381f4cf3a00aa4c802958b85fecd182ca4623b86febe13bfb
Instruction Fuzzy Hash: E13188B15183419FD718DF18C8A472AB7F1EF89348F48981EE5C6AB3A1E7389904CB56

Function 007A049B Relevance: .3, Instructions: 264
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8d5cad7240c2e3b086ebe7b2dae6592c21f3eff5dfbdce26a71867d0e1dc8ed
Instruction ID: e703edf22b69a57f09d1abb24674e1deed077d66a8f5892e1bf716e69188e1e9
Opcode Fuzzy Hash: e8d5cad7240c2e3b086ebe7b2dae6592c21f3eff5dfbdce26a71867d0e1dc8ed
Instruction Fuzzy Hash: 37918975201B00CFD724CF25E894A26B7F6FF89314B15CA6DE8568BAA1D738E815CB90

Function 007A0228 Relevance: .2, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa8724525834d2c124375e00a0d8588dacecbfc03f3253f6b20193ae90175a0b
Instruction ID: e3ee5a9d8be61396fad59fab6cdc3e3958f17108a1c86ddc11a3712834e6ba6a
Opcode Fuzzy Hash: aa8724525834d2c124375e00a0d8588dacecbfc03f3253f6b20193ae90175a0b
Instruction Fuzzy Hash: 4D718B74201700DFD7248F20EC94B16B7F6FF8A315F14C969E8568BAA2D739E815CB64

Function 007D99D0 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e62a2f34d7f6f40fec458a7fb940f26551e0f79e2dc0f032019c18f195867c86
Instruction ID: 284b948bf7464ff0752544a426ebe9d2d412c6311e0317d0759efd78bc0cd720
Opcode Fuzzy Hash: e62a2f34d7f6f40fec458a7fb940f26551e0f79e2dc0f032019c18f195867c86
Instruction Fuzzy Hash: BB41CC75208340ABD7149A15E890B2BF7B6EB89714F15C82EE6CA9B341D338E810CB66

Function 007D63B8 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 183bf0a27d1948102bf4c4ea1f977de8df1304d71cc3f84dbb1ea7e10ddd8b17
Instruction ID: 604a27a240fc91d59f7027d55ccb8a8be8d8361a1a7a273136126ea5fc7b011e
Opcode Fuzzy Hash: 183bf0a27d1948102bf4c4ea1f977de8df1304d71cc3f84dbb1ea7e10ddd8b17
Instruction Fuzzy Hash: B931F070249381BBDA24DB04CD82F3AB7B2EB84B15F64890DF2C15B3E1D378B8108B56

Function 007A0EEC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e4e4894fe719a55d988b47477a12ad40b0c6433318be6d6da3a642915075ccc
Instruction ID: d29e0ee1abec987849a2ad4e8eb4c0771a747c9b8834047050f9d4635d8cb588
Opcode Fuzzy Hash: 8e4e4894fe719a55d988b47477a12ad40b0c6433318be6d6da3a642915075ccc
Instruction Fuzzy Hash: 1E213CB490125ADFDB15CF94CC90BBEBBB1FB4A304F144909E911BB292C735A901CBA4

Function 007D3220 Relevance: 1.6, APIs: 1, Instructions: 59
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(?,00000000), ref: 007D32A6

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 3958cc8beab441ebeff05394ed3f2d9caef93f475e4642311fc1efb2bee12081
Instruction ID: 8094b3afc8f832a1bb91086ed7c2c8eca7ec27c7017a2b090ac123c6fbfe360e
Opcode Fuzzy Hash: 3958cc8beab441ebeff05394ed3f2d9caef93f475e4642311fc1efb2bee12081
Instruction Fuzzy Hash: 51016D3490D290DBC701EF18E889A1ABBF8EF4A700F05881DE5C58B361D339ED60CB96

Function 007D3202 Relevance: 1.5, APIs: 1, Instructions: 6
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,00000000), ref: 007D3208

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 1c917e65259020b86324380bb7130489e3c56acc8f837147a65f8bcd91266d20
Instruction ID: a43999b24ebc0434d57bb8d7634a871da04c063b29ea27f7f5fbe5bc3f0666ec
Opcode Fuzzy Hash: 1c917e65259020b86324380bb7130489e3c56acc8f837147a65f8bcd91266d20
Instruction Fuzzy Hash: B1B012300400005FDA141B00EC0AF043510EB00705F800050A1000C0B1D1B55C64C558

Non-executed Functions

Function 007C23E0 Relevance: 33.0, APIs: 4, Strings: 13, Instructions: 3298COMMON

Download Yara Rule

Strings

aenQ, xrefs: 007C276A
:, xrefs: 007C32DD
%*+(, xrefs: 007C40EF
|}&C, xrefs: 007C2F21
mlc@, xrefs: 007C275C
3<, xrefs: 007C32D6
Cx, xrefs: 007C453D
#v, xrefs: 007C344B, 007C4861
ggxz, xrefs: 007C2685
f@~!, xrefs: 007C25FF
`tii, xrefs: 007C2693
fedc, xrefs: 007C2782
{l`~, xrefs: 007C268C

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID: %*+($3<$:$Cx$`tii$aenQ$f@~!$fedc$ggxz$mlc@${l`~$|}&C$#v
API String ID: 0-2260822535
Opcode ID: 69bcebb71c3c67a3a18307cb69c2f117f8b361943bf3c5efa78f396bcb4149b3
Instruction ID: 04716bef9a0d57924a6fb9f251ccd1c86ffc0b70dc510cf8e209fdd946d47323
Opcode Fuzzy Hash: 69bcebb71c3c67a3a18307cb69c2f117f8b361943bf3c5efa78f396bcb4149b3
Instruction Fuzzy Hash: 04339B70505B818FD7258F38C590B62BBF1BF16304F58899DE4DA8BB92C739E906CB61

Function 007ADB6F Relevance: 32.0, Strings: 24, Instructions: 2006COMMON

Download Yara Rule

Strings

%*+(, xrefs: 007ADE37, 007ADE46
lkji, xrefs: 007AE73E
@ONM, xrefs: 007AE6DB
()./, xrefs: 007AE9CA
<=2, xrefs: 007AEA01
xgfe, xrefs: 007AE71D
WP, xrefs: 007ADCEF
LKJI, xrefs: 007AE6E6
AR, xrefs: 007ADD10
tuJK, xrefs: 007AE967
T, xrefs: 007AF157
:WUE, xrefs: 007AF6B7, 007AF6C6
D, xrefs: 007AE846
89>?, xrefs: 007AE9F6
QNOL, xrefs: 007AE775
<=:;, xrefs: 007AE930
|, xrefs: 007AECB1
tsrq, xrefs: 007AE6FC
mjkh, xrefs: 007AE7D8
dcba, xrefs: 007AE728
89&', xrefs: 007AE93B
`onm, xrefs: 007AE733
DCBA, xrefs: 007AE887, 007AE896
`Y^_, xrefs: 007AE99E

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID: InitializeThunk
String ID: %*+($()./$89&'$89>?$:WUE$<=2$<=:;$@ONM$AR$D$DCBA$LKJI$QNOL$T$WP$`Y^_$`onm$dcba$lkji$mjkh$tsrq$tuJK$xgfe$|
API String ID: 2994545307-1418943773
Opcode ID: 1804dd0719228689ace5f216caa6a858f21b7c78a5aa418d05b50cbcac5dcab0
Instruction ID: 787b8be8a4188d3c57b267fc965d26ad795f3742d85073ce06164bc8dc925406
Opcode Fuzzy Hash: 1804dd0719228689ace5f216caa6a858f21b7c78a5aa418d05b50cbcac5dcab0
Instruction Fuzzy Hash: 55F289B05093819FD770CF14C894BABBBE2BFD6304F14492DE4C98B252E7399995CB92

Function 007B9F62 Relevance: 21.7, Strings: 17, Instructions: 473COMMON

Download Yara Rule

Strings

WH, xrefs: 007BAA1C
CG, xrefs: 007BAA32
N[, xrefs: 007BA375
sm, xrefs: 007BA830
_Y, xrefs: 007BA641
]{, xrefs: 007BA1E7, 007BA1F3
/), xrefs: 007BA66D
WQ, xrefs: 007BA62B
hi, xrefs: 007BAB9D
=], xrefs: 007BA36A
%e6g, xrefs: 007BA152
JG, xrefs: 007BAA27
?m,o, xrefs: 007BA13C
kW, xrefs: 007BA380
(a*c, xrefs: 007BA147
S], xrefs: 007BA636
Gt, xrefs: 007B9FF8

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID: %e6g$(a*c$=]$?m,o$CG$Gt$JG$N[$WH$]{$hi$kW$/)$S]$WQ$_Y$sm
API String ID: 0-1131134755
Opcode ID: 5100feacfe1f0a0d253a2ebe0ba3c095160c67af5eecbd1355a5b62c0a6ed233
Instruction ID: b1848f6a1c942aee7c48b25377eff469e471e2ad7849653706d30a396eecfee7
Opcode Fuzzy Hash: 5100feacfe1f0a0d253a2ebe0ba3c095160c67af5eecbd1355a5b62c0a6ed233
Instruction Fuzzy Hash: C752C6B804D385CAE271CF25D581B8EBAF1BB92740F608A1DE1ED9B255DBB48045CF93

Function 007B9510 Relevance: 20.4, Strings: 16, Instructions: 427COMMON

Download Yara Rule

Strings

z=Q?, xrefs: 007B9826
pq, xrefs: 007B99E0
X/R), xrefs: 007B9AEB
,A&C, xrefs: 007B982E
?M0K, xrefs: 007B9968
;IJK, xrefs: 007B983E
!E4G, xrefs: 007B9836
B7U1, xrefs: 007B9AFB
L3Y=, xrefs: 007B9B03
T#a-, xrefs: 007B9AE3
2A"_, xrefs: 007B9980
8;, xrefs: 007B9B13
G+X5, xrefs: 007B9AF3
B?Q9, xrefs: 007B9B0B
G'M!, xrefs: 007B9ADB
O+f), xrefs: 007B9634, 007B963D

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID: !E4G$,A&C$2A"_$8;$;IJK$?M0K$B7U1$B?Q9$G'M!$G+X5$L3Y=$O+f)$T#a-$X/R)$pq$z=Q?
API String ID: 0-655414846
Opcode ID: 5d9011f5caba11a8caab232d9eb9ab56991c76e528b1a37e7b24cfea9eed625e
Instruction ID: b1f7aca4345647401efe43db6871c07ed571b485da825bc2a94d2ef37a16985d
Opcode Fuzzy Hash: 5d9011f5caba11a8caab232d9eb9ab56991c76e528b1a37e7b24cfea9eed625e
Instruction Fuzzy Hash: 49F13FB0508380ABD310DF15D881A6BBBF4FB8AB48F544D1CF6E59B252D378D908CB96

Function 007BDD29 Relevance: 18.6, Strings: 14, Instructions: 1142COMMON

Download Yara Rule

Strings

r{, xrefs: 007BE92E
=]+_, xrefs: 007BE276
<Y.[, xrefs: 007BE27D
)IgK, xrefs: 007BE261
,Q?S, xrefs: 007BE26F
-M2O, xrefs: 007BE25A
n\+H, xrefs: 007BDDC0
{, xrefs: 007BE403, 007BE664, 007BE7BD
{, xrefs: 007BE9C5
Y9N;, xrefs: 007BE245
upH}, xrefs: 007BDE8A, 007BE798, 007BDF4A
{E, xrefs: 007BE323
%*+(, xrefs: 007BE143
hX]N, xrefs: 007BDDC7

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID: {$%*+($)IgK$,Q?S$-M2O$<Y.[$=]+_$Y9N;$hX]N$n\+H$r{$upH}${E${
API String ID: 0-1910484863
Opcode ID: be98b720c05b2ac2320694c70c9b29732d7434cab9d2acb51ed245e2d2321319
Instruction ID: 067c9b3c78ca6d392dab10281c6c81f922cb4af84b9db43a55286977217a2fdd
Opcode Fuzzy Hash: be98b720c05b2ac2320694c70c9b29732d7434cab9d2acb51ed245e2d2321319
Instruction Fuzzy Hash: CB9225B1E00245CFDB14CF68D8917AEBBB2FF49310F698168E416AB391D739AD41CB94

Function 0094C959 Relevance: 11.4, Strings: 8, Instructions: 1379COMMON

Download Yara Rule

Strings

/w~, xrefs: 0094CB1C
Ayc, xrefs: 0094CAAB
A}}, xrefs: 0094D4DF
`<N, xrefs: 0094D40A
~o;, xrefs: 0094D840
Jo:k, xrefs: 0094D835
ylY, xrefs: 0094D05A
Ei, xrefs: 0094D00E

Memory Dump Source

Source File: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID: A}}$Ei$Jo:k$`<N$ylY$~o;$/w~$Ayc
API String ID: 0-279430079
Opcode ID: 30735054c8e1d28b1c2910a152a3dd7cf18dfb5f0c53dcb5d07eb368daf25713
Instruction ID: 4b73719cfeb0c66d75b6fd01d86d2509a599a832735c3253bec22c1cdd72fee2
Opcode Fuzzy Hash: 30735054c8e1d28b1c2910a152a3dd7cf18dfb5f0c53dcb5d07eb368daf25713
Instruction Fuzzy Hash: FF92D4F36082009FE304AE2DEC85A7AB7E9EF94720F1A493DE6C4C7744E63598458797

Function 007B098B Relevance: 10.8, Strings: 8, Instructions: 836COMMON

Download Yara Rule

Strings

cah`, xrefs: 007B107E
&> &, xrefs: 007B0F89
,#15, xrefs: 007B0F94
{, xrefs: 007B1502
9.5^, xrefs: 007B0F9F
qrqp, xrefs: 007B1089
gce/, xrefs: 007B1073
%*+(, xrefs: 007B0A77, 007B0A86

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID: %*+($&> &$,#15$9.5^$cah`$gce/$qrqp${
API String ID: 0-4102007303
Opcode ID: e9e7208c11f3560bbcf9bf5e7763686e62aafe543c54bc11277187cd36b7aa3b
Instruction ID: 7e75a4dba5b8574dfac8c03554c88538dab1cba6a6e8cc34f9e4cd06360ce5b3
Opcode Fuzzy Hash: e9e7208c11f3560bbcf9bf5e7763686e62aafe543c54bc11277187cd36b7aa3b
Instruction Fuzzy Hash: FD629AB1608381CBD730CF14D895BABB7E1FF96314F48892DE49A8B641E3799941CB93

Function 00791000 Relevance: 10.5, Strings: 7, Instructions: 1785COMMON

Download Yara Rule

Strings

gfff, xrefs: 00792297
@, xrefs: 00792C40
0123456789ABCDEFXP, xrefs: 0079157D, 007915EB
gfff, xrefs: 007922E1
-, xrefs: 007921ED
gfff, xrefs: 00792226
0123456789abcdefxp, xrefs: 00791587, 007915F8

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID: -$0123456789ABCDEFXP$0123456789abcdefxp$@$gfff$gfff$gfff
API String ID: 0-2517803157
Opcode ID: 8fa8e0611cea32879c1e0471d318d79ad01e7652e906262f5552588c8b09d4ce
Instruction ID: 999f31ac4e76d1422b4244eb7f22a5543409dc8d7ce28e96091ec4186a042253
Opcode Fuzzy Hash: 8fa8e0611cea32879c1e0471d318d79ad01e7652e906262f5552588c8b09d4ce
Instruction Fuzzy Hash: 71D2E5716083429FDB18CE28D49436ABBE2AFD5314F18C62DE499C7392D778DD46CB82

Function 009566F9 Relevance: 10.4, Strings: 7, Instructions: 1631COMMON

Download Yara Rule

Strings

s)m, xrefs: 00957A20
SF7=, xrefs: 0095677D
LL{{, xrefs: 00957A1A
R[}, xrefs: 00956880
+cu, xrefs: 00957672
WMvw, xrefs: 00956DC1
Z=Z;, xrefs: 009573E3

Memory Dump Source

Source File: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID: +cu$LL{{$SF7=$WMvw$Z=Z;$s)m$R[}
API String ID: 0-980839415
Opcode ID: 96c119b9422d845869ca53f3bf8196322ca977976c6fb77d8dc980b0f8523a0c
Instruction ID: 5c8ad8c356487e980d4cce67b2c765d4b27582df51471fc753553587dd5fee28
Opcode Fuzzy Hash: 96c119b9422d845869ca53f3bf8196322ca977976c6fb77d8dc980b0f8523a0c
Instruction Fuzzy Hash: 60B2F9F3A081009FE304AE2DEC4567ABBE9EFD4720F1A893DEAC4C7744E53598158697

Function 0094E136 Relevance: 9.1, Strings: 6, Instructions: 1601COMMON

Download Yara Rule

Strings

N(v?, xrefs: 0094E84D
7v>/, xrefs: 0094E41C
"3, xrefs: 0094E7F7
7u&x, xrefs: 0094E7D4
4OI, xrefs: 0094EAF3
Hk, xrefs: 0094EA0F

Memory Dump Source

Source File: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID: 4OI$7u&x$7v>/$N(v?$"3$Hk
API String ID: 0-1594881798
Opcode ID: 88cd0e8026932b7057f4e4acdb8282184ce9a0f34312c4008248af17c28c7e4e
Instruction ID: c2528b8b79dfb953023d123a5c2b72de50394c0a71d2ceb6c5b4ef4e991e71d1
Opcode Fuzzy Hash: 88cd0e8026932b7057f4e4acdb8282184ce9a0f34312c4008248af17c28c7e4e
Instruction Fuzzy Hash: DAB209F3A0C2009FE7046F29EC8567ABBE9EF94720F16893DEAC5C3744E63558058697

Function 00958B0C Relevance: 7.2, Strings: 5, Instructions: 933COMMON

Download Yara Rule

Strings

d69o, xrefs: 009595F2
wsu, xrefs: 00958F4E
q~E, xrefs: 00958B91
WO}, xrefs: 00958BC7
Ntoo, xrefs: 00959022

Memory Dump Source

Source File: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID: Ntoo$WO}$d69o$q~E$wsu
API String ID: 0-2235047945
Opcode ID: a1f58a2c9e425f036000ed1fbd9fb73652060f902543200ac82c0e8ffe52ec9b
Instruction ID: ea93cbe3c681cfd72d8a9d73d625cdef9d85be3b8aa5cd2a6f1cadba936d60d1
Opcode Fuzzy Hash: a1f58a2c9e425f036000ed1fbd9fb73652060f902543200ac82c0e8ffe52ec9b
Instruction Fuzzy Hash: 6C5216F360C304AFE3046E6DEC85A7ABBD9EB94320F16463DE6C5C3740EA3599058697

Function 007912F7 Relevance: 7.2, Strings: 5, Instructions: 922COMMON

Download Yara Rule

Strings

0, xrefs: 00791DC1
@, xrefs: 00793531
0, xrefs: 0079243E
i, xrefs: 007928EA
0, xrefs: 00791E88

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID: 0$0$0$@$i
API String ID: 0-3124195287
Opcode ID: 9058de33c86dc34f515ec1036bed41c85294b8d61ec9955e7a6b9ecccbc3bd6c
Instruction ID: 220b845143581a8342d7147ef32c68efbc3ce067e0a5985b5803147abf355600
Opcode Fuzzy Hash: 9058de33c86dc34f515ec1036bed41c85294b8d61ec9955e7a6b9ecccbc3bd6c
Instruction Fuzzy Hash: 9262F57160C3829BCB19DF28D49076ABBE1AFD5304F18895DE4D987392D378DD46CB82

Function 0079164F Relevance: 6.7, Strings: 5, Instructions: 472COMMON

Download Yara Rule

Strings

gfff, xrefs: 00791F57
0123456789ABCDEFXP, xrefs: 0079164F
gfff, xrefs: 00791F3C
+, xrefs: 00791573
0123456789abcdefxp, xrefs: 00791659

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID: +$0123456789ABCDEFXP$0123456789abcdefxp$gfff$gfff
API String ID: 0-1123320326
Opcode ID: 280afc4c0ccb338bc3d150577a0e43935cc3a95a687c182bf2a9378d12d99057
Instruction ID: 649657ac34e0202382f2220c9f467b16e8e099f5ac15bcb4fe5a0c208983b9ff
Opcode Fuzzy Hash: 280afc4c0ccb338bc3d150577a0e43935cc3a95a687c182bf2a9378d12d99057
Instruction Fuzzy Hash: 64F1B33160C3829FCB15CE28D48426AFBE2AFD9304F18CA6DE4D987352D738D945CB92

Function 007913A3 Relevance: 6.6, Strings: 5, Instructions: 390COMMON

Download Yara Rule

Strings

gfff, xrefs: 00791F57
0123456789ABCDEFXP, xrefs: 007913A3
gfff, xrefs: 00791F3C
-, xrefs: 00791F23
0123456789abcdefxp, xrefs: 007913AD

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID: -$0123456789ABCDEFXP$0123456789abcdefxp$gfff$gfff
API String ID: 0-3620105454
Opcode ID: b2969e66b532d41c653da5a8c59a7bac8eaf358828ada1118444b3ee7b3262a9
Instruction ID: 1addc5ca6bed6027238bc77d36f4a84cc2b7dcb59b51f72ff7184aa98c5d277f
Opcode Fuzzy Hash: b2969e66b532d41c653da5a8c59a7bac8eaf358828ada1118444b3ee7b3262a9
Instruction Fuzzy Hash: D9D1A07160C7829FCB15CE29D48426AFFE2AFD9304F08CA6DE4D987352D638D949CB52

Function 0094AB2B Relevance: 6.6, Strings: 4, Instructions: 1634COMMON

Download Yara Rule

Strings

N{]^, xrefs: 0094B9F3
Un<, xrefs: 0094BB8C
,-, xrefs: 0094B8CF
Idl8, xrefs: 0094BA2E

Memory Dump Source

Source File: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID: Idl8$N{]^$Un<$,-
API String ID: 0-1481134740
Opcode ID: 2e1dfa4f078395deca420f14825f9428585800ee0b326c7083af8ba4e6795008
Instruction ID: 00e0eeb5676630a35b60cf95f7c2e2351ce5ec16799a01ad9c03d916e8b8b30c
Opcode Fuzzy Hash: 2e1dfa4f078395deca420f14825f9428585800ee0b326c7083af8ba4e6795008
Instruction Fuzzy Hash: 1EB2F8F3A0C204AFE3046E2DEC8567ABBE9EF94720F16493DEAC4C3744E67558058697

Function 0094FB7A Relevance: 6.5, Strings: 4, Instructions: 1530COMMON

Download Yara Rule

Strings

Q\U, xrefs: 00950CD6
O8, xrefs: 0095069E
\%-, xrefs: 009505D7
(2^, xrefs: 00950B9E

Memory Dump Source

Source File: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID: (2^$O8$Q\U$\%-
API String ID: 0-3861073225
Opcode ID: 09c2f1a002a0d710846ac6114b14b29205f52bd06e43a6a25cfdb5a7eb7e38b1
Instruction ID: f31c29ed7acab37930766d513622edc11b066cb4c37732f2a50963680ae605b0
Opcode Fuzzy Hash: 09c2f1a002a0d710846ac6114b14b29205f52bd06e43a6a25cfdb5a7eb7e38b1
Instruction Fuzzy Hash: BCA208F3A0C204AFE3046E2DDC8567ABBE9EF94720F1A493DE6C4C3744E67598058697

Function 00949BB0 Relevance: 5.7, Strings: 4, Instructions: 717COMMON

Download Yara Rule

Strings

o0g, xrefs: 0094A33D
*@g, xrefs: 00949C61
*@g, xrefs: 00949CB6
<.^, xrefs: 0094A37E

Memory Dump Source

Source File: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID: *@g$*@g$<.^$o0g
API String ID: 0-2334143189
Opcode ID: 7d2b01b36facd41bfeb495a913291a61cbb90c503726247bd6a1fe3695a2c85c
Instruction ID: 75d55a458cbce199169173b6c0c45e8b75a3eecb580e522388402d6d5a66374c
Opcode Fuzzy Hash: 7d2b01b36facd41bfeb495a913291a61cbb90c503726247bd6a1fe3695a2c85c
Instruction Fuzzy Hash: EF32B4F260C2049FD304AF29EC8567ABBE5EF98720F15893DE6C4C7744E63598418B97

Function 007BFD10 Relevance: 5.7, Strings: 4, Instructions: 667COMMON

Download Yara Rule

Strings

m1s3, xrefs: 007BFEC3, 007BFECB
NA_I, xrefs: 007C036D
uvw, xrefs: 007BFE95
:, xrefs: 007C0087

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID: :$NA_I$m1s3$uvw
API String ID: 0-3973114637
Opcode ID: 61095f52b3b9ad04f0f44cc05d8a7ead11700a38f94354c0ac56607ea3492e75
Instruction ID: 2385f498cf66d60f59c412ba39059316ee11777d4dca975cc630584b41719d3f
Opcode Fuzzy Hash: 61095f52b3b9ad04f0f44cc05d8a7ead11700a38f94354c0ac56607ea3492e75
Instruction Fuzzy Hash: 1532BAB0509380DFD311DF28D881B2ABBE1FB8A304F548A6CF5D58B292D339D955CB96

Function 007A3BE2 Relevance: 5.4, Strings: 4, Instructions: 431COMMON

Download Yara Rule

Strings

%*+(, xrefs: 007A3EC4
;z, xrefs: 007A3C87
p, xrefs: 007A3C80
ss, xrefs: 007A3C79

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID: %*+($;z$p$ss
API String ID: 0-2391135358
Opcode ID: 29a3db0ab07db5012265d0ac1bf844a62ae7c3c5bac36773770648cb88680b68
Instruction ID: d11c41cbb11ca6a764d1df28d38bd83af8cf0c911ec0590664d1a6cb8f598a9e
Opcode Fuzzy Hash: 29a3db0ab07db5012265d0ac1bf844a62ae7c3c5bac36773770648cb88680b68
Instruction Fuzzy Hash: 67026DB4810700EFD760DF24D986756BFF4FB46300F508A5DE89A8B656E335E815CBA2

Function 007B2260 Relevance: 5.4, Strings: 4, Instructions: 383COMMON

Download Yara Rule

Strings

a|, xrefs: 007B2317
lc, xrefs: 007B2507
sj, xrefs: 007B2327
hu, xrefs: 007B232F

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID: a|$hu$lc$sj
API String ID: 0-3748788050
Opcode ID: d7bc7992f0ee84537609db4864315b63d6ddb73f6ac9e32039e20f2a0c012044
Instruction ID: b6b19dc66e1010ad7c0fb65405741bc6a0c9a14463b29310f96f96024766e56e
Opcode Fuzzy Hash: d7bc7992f0ee84537609db4864315b63d6ddb73f6ac9e32039e20f2a0c012044
Instruction Fuzzy Hash: 24A18B704093418BC720DF18C891B6BB7F0FF96354F548A0CE8D59B2A2E339D952CBA6

Function 00951636 Relevance: 5.3, Strings: 3, Instructions: 1569COMMON

Download Yara Rule

Strings

Ne{?, xrefs: 0095201D
6.z_, xrefs: 00951C49
pUo, xrefs: 009524A7

Memory Dump Source

Source File: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID: pUo$6.z_$Ne{?
API String ID: 0-3877039594
Opcode ID: 6cf9598c13327ac5621f33460053d62d4b386b043643aaae3296c6ac9df80415
Instruction ID: a0cbe5458c69fa1668782a497956e75766d6d7530add5eb1a2d66b5acca0dbe9
Opcode Fuzzy Hash: 6cf9598c13327ac5621f33460053d62d4b386b043643aaae3296c6ac9df80415
Instruction Fuzzy Hash: A7B2C5F3A0C2009FE3046E2DEC8567AF7E9EF94720F16893DE6C4C7744EA3598458696

Function 007BD7AF Relevance: 5.2, Strings: 4, Instructions: 213COMMON

Download Yara Rule

Strings

T>, xrefs: 007BD984
CV, xrefs: 007BD98B
KV, xrefs: 007BD97D
#', xrefs: 007BD9EA

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID: #'$CV$KV$T>
API String ID: 0-95592268
Opcode ID: 650eebc98ba2eb7ab9fdb219f32f2cce75292c3acaeb202d26a55ca035f17317
Instruction ID: 4e4031c6f4717db6faf30056fdb2cb9954aa5334edd051aef387bf7f85674c99
Opcode Fuzzy Hash: 650eebc98ba2eb7ab9fdb219f32f2cce75292c3acaeb202d26a55ca035f17317
Instruction Fuzzy Hash: 6E8166B4801B45DBDB20DF95D28569EBFB1FF12300F60460CE4866BA55D334AA55CFE2

Function 007BAC91 Relevance: 5.1, Strings: 4, Instructions: 128COMMON

Download Yara Rule

Strings

,{*y, xrefs: 007BAD07, 007BAD13
4c2a, xrefs: 007BACA9
lk, xrefs: 007BACBC
(g6e, xrefs: 007BACA1

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID: (g6e$,{*y$4c2a$lk
API String ID: 0-1327526056
Opcode ID: 4d6f2448d886c9304c85459730539e80a65d5771edab00ab327053870bf09e31
Instruction ID: c64e9bd83e418ebdc5424fe3170df3f29d09d7457c9634e9fa75ff7fe91b81ec
Opcode Fuzzy Hash: 4d6f2448d886c9304c85459730539e80a65d5771edab00ab327053870bf09e31
Instruction Fuzzy Hash: A64194B4409381DBD7209F20D944BABB7F0FF86305F54995DE5C89B220EB39D944CB9A

Function 007BC470 Relevance: 4.2, Strings: 3, Instructions: 419COMMON

Download Yara Rule

Strings

%*+(, xrefs: 007BC9E4, 007BC9ED
%*+(, xrefs: 007BC8C3, 007BC8CB
~/i!, xrefs: 007BC537

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID: %*+($%*+($~/i!
API String ID: 0-4033100838
Opcode ID: 0fa2fb82c2a5c3f31f20fb2a86134016897f7d11b45bb90f9cfe445fe662b03f
Instruction ID: 9b22a11ac8df6376570e8a8896439e6ff19c2138e69b6f9ff11552a3cf924cb4
Opcode Fuzzy Hash: 0fa2fb82c2a5c3f31f20fb2a86134016897f7d11b45bb90f9cfe445fe662b03f
Instruction Fuzzy Hash: 4EE187B5519380DFE7209F24D885B5EBBF5FB89344F48C82CE6898B251DB39D814CB92

Function 00798590 Relevance: 4.1, Strings: 3, Instructions: 387COMMON

Download Yara Rule

Strings

), xrefs: 00798616
IEND, xrefs: 007989F0
), xrefs: 0079860C

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID: )$)$IEND
API String ID: 0-588110143
Opcode ID: 2f356482fd05ef0ca9a2789b756c13610a6434ab75c00061d36a473954f9bae4
Instruction ID: 209695ce5cd77c7cac2dfa8897b8276a06cc7bb05fb132b2d862e45267ac6e75
Opcode Fuzzy Hash: 2f356482fd05ef0ca9a2789b756c13610a6434ab75c00061d36a473954f9bae4
Instruction Fuzzy Hash: AAE1E2B1A087019FDB50CF28D84572ABBE0FB95314F14892DE5999B382DB79E914CBC3

Function 007D4040 Relevance: 3.1, Strings: 2, Instructions: 577COMMON

Download Yara Rule

Strings

f, xrefs: 007D420C
%*+(, xrefs: 007D40A4, 007D40AD

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID: %*+($f
API String ID: 0-2038831151
Opcode ID: 545b94a4b58ba5abb21e18877c86efd95d9e23df524ada8ddea6d1659faa4071
Instruction ID: 81332a2c1f5c60c8e28e6112bef86d918f2055564993c4584fc7455b4bdfab83
Opcode Fuzzy Hash: 545b94a4b58ba5abb21e18877c86efd95d9e23df524ada8ddea6d1659faa4071
Instruction Fuzzy Hash: 7D128A716083419FC714CF18C880B2ABBF6FB89314F588A2EF5959B391D739E945CB92

Function 009558CC Relevance: 3.0, Strings: 2, Instructions: 525COMMON

Download Yara Rule

Strings

`&?w, xrefs: 0095593D
"=, xrefs: 00955F09

Memory Dump Source

Source File: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID: "=$`&?w
API String ID: 0-3878392957
Opcode ID: 1009b40b144fda05ec7600f3be8bc3d0c188adaba3f98fadafcd56ae16d01a07
Instruction ID: 5aec4a635dd4f04beafb67e7ab720e0f88a235932e1eaa9138769fc4c6c30356
Opcode Fuzzy Hash: 1009b40b144fda05ec7600f3be8bc3d0c188adaba3f98fadafcd56ae16d01a07
Instruction Fuzzy Hash: 2CF19BF3608204AFE304AE7DDC8577BBBD9EB94220F1A863DE6C1C3744F97599058296

Function 007CF620 Relevance: 3.0, Strings: 2, Instructions: 461COMMON

Download Yara Rule

Strings

hi, xrefs: 007CF6E6
dg, xrefs: 007CF7F5

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID: dg$hi
API String ID: 0-2859417413
Opcode ID: 77341bfc9fdfdf0277d11a01fa66140c18eed96188410b334346413499370dc3
Instruction ID: 559d478e4fa3f736a290c9e264b6b9d71beaed715813acfe306a1f2537453c40
Opcode Fuzzy Hash: 77341bfc9fdfdf0277d11a01fa66140c18eed96188410b334346413499370dc3
Instruction Fuzzy Hash: C7F19571619341EFE704CF24D891B2ABBF6FB89344F14992CF4858B2A2D738D945CB16

Function 007935B0 Relevance: 2.9, Strings: 2, Instructions: 411COMMON

Download Yara Rule

Strings

NaN, xrefs: 0079360E
Inf, xrefs: 00793607

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID: Inf$NaN
API String ID: 0-3500518849
Opcode ID: 18601b405885880913109f24fcf6d175c7eac80b4f2930e195e5b7c7095f8fa7
Instruction ID: 8cafdf61eaadd39bc5b271675ea7efeaafba694d37ae71baf3eaa0945e5832f7
Opcode Fuzzy Hash: 18601b405885880913109f24fcf6d175c7eac80b4f2930e195e5b7c7095f8fa7
Instruction Fuzzy Hash: 59D1E671A083119BCB14CF29D88061EB7E1EFC8750F158A2DF999973A0E779DD058B82

Function 007AFFDF Relevance: 2.7, Strings: 2, Instructions: 185COMMON

Download Yara Rule

Strings

Ye[g, xrefs: 007B00F6
BaBc, xrefs: 007B0197

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID: BaBc$Ye[g
API String ID: 0-286865133
Opcode ID: 06089e62239f760aa1a65083532601de2ef6d50396221812e104ecb3bac2d320
Instruction ID: f9918c8ef291a991106397f23372e5cb249a1b72c68e38c1204082dbab189e71
Opcode Fuzzy Hash: 06089e62239f760aa1a65083532601de2ef6d50396221812e104ecb3bac2d320
Instruction Fuzzy Hash: 3F519BB16083858BD731DF18C885BABB7E4FF96320F08491DE49A8B651E3789940CB96

Function 00795160 Relevance: 1.8, Strings: 1, Instructions: 577COMMON

Download Yara Rule

Strings

%1.17g, xrefs: 007954C8

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID: %1.17g
API String ID: 0-1551345525
Opcode ID: 44d74ec7bfd7f07c5045286f4e05a2bb28039f04e39aa47359c54a496e0504d0
Instruction ID: f9451c41c258d1987fb884227e50b1bb20b26d4b62e752ae4d00bc537626db12
Opcode Fuzzy Hash: 44d74ec7bfd7f07c5045286f4e05a2bb28039f04e39aa47359c54a496e0504d0
Instruction Fuzzy Hash: 3A2213B2A08B62CBEF168E18E840726BBE3AFE0318F1D856DD8594B351E779DD05C741

Function 007C12D0 Relevance: 1.7, Strings: 1, Instructions: 484COMMON

Download Yara Rule

Strings

", xrefs: 007C15D1

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 1e36e4a90a5bcd9904d9a2755a98640d2f51fe7f53356f7c076c40d918f289ea
Instruction ID: bb8bc46289cf4438481be7203bf1635b27cf16f68ed5e054ca36f3ace5decfd3
Opcode Fuzzy Hash: 1e36e4a90a5bcd9904d9a2755a98640d2f51fe7f53356f7c076c40d918f289ea
Instruction Fuzzy Hash: A5F10471A083418FC725CE24C494F2BBBE6ABC6354F58C57DE89A87383D638DD458792

Function 007BAE57 Relevance: 1.7, Strings: 1, Instructions: 455COMMON

Download Yara Rule

Strings

%*+(, xrefs: 007BB2D3, 007BB2DB

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 51a25dc817d3ea6e45be17e44486e3d302dbd53a0753d530a9e9950fe454e295
Instruction ID: 0c98b9b5af3c98d522f1ad6c6b723771123f669a3fe1db57c00107af2164ee2b
Opcode Fuzzy Hash: 51a25dc817d3ea6e45be17e44486e3d302dbd53a0753d530a9e9950fe454e295
Instruction Fuzzy Hash: 60E1BD71508346DBC314EF28C8906AEB7F2FF98781F54891CE8C587221E379E995CB82

Function 007A6EBF Relevance: 1.7, Strings: 1, Instructions: 447COMMON

Download Yara Rule

Strings

%*+(, xrefs: 007A6EF3

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 2376b22d282eb0d086e6c5ce951a13e4c3ebe650d02639f3a57ac7af26ced5dd
Instruction ID: 2b9d71d9f3c6d00e46e9f2b764fa324963e43325131820235c5c43e6e87fffef
Opcode Fuzzy Hash: 2376b22d282eb0d086e6c5ce951a13e4c3ebe650d02639f3a57ac7af26ced5dd
Instruction Fuzzy Hash: 15F1A1B5A00B01CFC725DF24D891A26B3F2FF89314B188A2DD49787691EB38F915CB55

Function 007B7E60 Relevance: 1.7, Strings: 1, Instructions: 425COMMON

Download Yara Rule

Strings

%*+(, xrefs: 007B8263, 007B826B

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: c00fb3a09a3445b7d713cf80fc24395bffc995e3f3e43ddcad817ac756a215f7
Instruction ID: 8e8782be313343d2a529ac6c43ed41c4ece6c6c20ce12322907694199c6f0bb6
Opcode Fuzzy Hash: c00fb3a09a3445b7d713cf80fc24395bffc995e3f3e43ddcad817ac756a215f7
Instruction Fuzzy Hash: 03C1C071509204ABD710AB18C886BABB7F9EF95354F48881CF8C59B251E738EC11CBA3

Function 007B8D62 Relevance: 1.7, Strings: 1, Instructions: 410COMMON

Download Yara Rule

Strings

%*+(, xrefs: 007B9233, 007B923B

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: c514065c80402b0fbbccf6599ef827848a5baafbed83c0d911fb7634f30d3181
Instruction ID: 55b37093512e27b67a5d7f6a5925ae0f7d10e545f9e3f2a702ad6f5ef5be9115
Opcode Fuzzy Hash: c514065c80402b0fbbccf6599ef827848a5baafbed83c0d911fb7634f30d3181
Instruction Fuzzy Hash: 0CD1CF70619342DFD704DF68DC90A6AB7E5FF8D304F49886CE5868B251D778E890CB91

Function 007A4487 Relevance: 1.6, Strings: 1, Instructions: 389COMMON

Download Yara Rule

Strings

BIz, xrefs: 007A485E

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID: BIz
API String ID: 0-490007762
Opcode ID: c381f2c8efe2801eeed8dd36545b155b1d416bd7272b44e375c8920731969555
Instruction ID: f6333a3833ce9ed3174c9cdf42569b1c3116045e98c8a20d0bcaf717f6898a46
Opcode Fuzzy Hash: c381f2c8efe2801eeed8dd36545b155b1d416bd7272b44e375c8920731969555
Instruction Fuzzy Hash: 62E10FB5601B40CFD321CF28E996B97B7E1FF46708F04886DE4AA87752E779B8148B14

Function 007D7FC0 Relevance: 1.6, Strings: 1, Instructions: 387COMMON

Download Yara Rule

Strings

P, xrefs: 007D8167

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID: P
API String ID: 0-3110715001
Opcode ID: 48908b2eb54a08c58733a0905dcf107f81633108479b2a153ffb255cc4c5bf1c
Instruction ID: 5de32a42f48401513f643d837823a24841149b5545406aa71afa8e496151cdce
Opcode Fuzzy Hash: 48908b2eb54a08c58733a0905dcf107f81633108479b2a153ffb255cc4c5bf1c
Instruction Fuzzy Hash: 3FD1D4729082658FC725CE18D89071EB6F1EB85718F19863DE8A5AB380DB79DC46C7C2

Function 007D6CBF Relevance: 1.6, Strings: 1, Instructions: 384COMMON

Download Yara Rule

Strings

"p}, xrefs: 007D7015

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID: "p}
API String ID: 0-3305324523
Opcode ID: a743f77b454bc554dfe3315cd8423d270d159c7385e0860ce228010e07d94cc4
Instruction ID: 854667384e0bf063e497cc9ee0532066bf516fed5fc394bfce2b9a24f2e3a2cf
Opcode Fuzzy Hash: a743f77b454bc554dfe3315cd8423d270d159c7385e0860ce228010e07d94cc4
Instruction Fuzzy Hash: ABD1D036619795CFC714CF38D8C052AB7E2AB8D314F198AADD491CB3A1D338DA44CB95

Function 007BCCD0 Relevance: 1.6, Strings: 1, Instructions: 357COMMON

Download Yara Rule

Strings

%*+(, xrefs: 007BCDC3, 007BCDCB

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID: InitializeThunk
String ID: %*+(
API String ID: 2994545307-3233224373
Opcode ID: d732f88215711ecdf527667fdbd73412a9f1faf451544f2f90d3bfff3e6d9a5b
Instruction ID: a0d12770bef9421b66af059635a2e15e564521af290f779b19b6f60f0f81a3e3
Opcode Fuzzy Hash: d732f88215711ecdf527667fdbd73412a9f1faf451544f2f90d3bfff3e6d9a5b
Instruction Fuzzy Hash: B5B1FE71A09305CFDB15EF14D890B6BBBE2EF85340F14882CE5C58B252E339E855CBA6

Function 0079A850 Relevance: 1.5, Strings: 1, Instructions: 271COMMON

Download Yara Rule

Strings

,, xrefs: 0079A9C3

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: 6a3fef2072c4110c7e08f213014c8aa891b97c95317c3c670d38149bab24221c
Instruction ID: e0dc8ec8087eb161e5b23d54427b7f103eeb0136d76962bf267353c56f0e422d
Opcode Fuzzy Hash: 6a3fef2072c4110c7e08f213014c8aa891b97c95317c3c670d38149bab24221c
Instruction Fuzzy Hash: 19B138702093819FC721CF18D88461BFBE1AFA9704F448A2DF5D997342D235EA08CBA7

Function 007CFC20 Relevance: 1.5, Strings: 1, Instructions: 265COMMON

Download Yara Rule

Strings

%*+(, xrefs: 007CFCA4, 007CFCAD

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 2f21fe5138b414ae6a31b11b1084a53fbee244d903f1fbd30b5d1ce5f54fc4eb
Instruction ID: 1add1bfc92d74123d61c3465b31389b8646dc72dcc6ba2bb58ab999a8bc1b5ef
Opcode Fuzzy Hash: 2f21fe5138b414ae6a31b11b1084a53fbee244d903f1fbd30b5d1ce5f54fc4eb
Instruction Fuzzy Hash: 7581CBB0209345EBD710DF68D884F2AB7F6FB99705F04882CF5859B292D739D825CB62

Function 007AD457 Relevance: 1.5, Strings: 1, Instructions: 248COMMON

Download Yara Rule

Strings

%*+(, xrefs: 007AD663, 007AD66B

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 7c70cfece16b3b9b22640685c05de929cb3de0c1c67d10211a3417b5da7b7a61
Instruction ID: 1736f29f4d8ea665b552625a322ba1bbee41ec2d816f27e53bf17c3a08769cc2
Opcode Fuzzy Hash: 7c70cfece16b3b9b22640685c05de929cb3de0c1c67d10211a3417b5da7b7a61
Instruction Fuzzy Hash: 6761F4B1905204DBDB20EF58DC82A2AB3B1FF99354F484A2DF9868B351E379DD10C796

Function 00912F74 Relevance: 1.5, Strings: 1, Instructions: 247COMMON

Download Yara Rule

Strings

\M_=, xrefs: 009131D4

Memory Dump Source

Source File: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID: \M_=
API String ID: 0-3180755999
Opcode ID: 023133de7f7745acfe8040e9bb5df7c297db41706b34a6c5970024a5012aa5d6
Instruction ID: db5f1645bfc67056e6848c5cc9a848dc08dd9115fca5a4d94961b7b8ee76b091
Opcode Fuzzy Hash: 023133de7f7745acfe8040e9bb5df7c297db41706b34a6c5970024a5012aa5d6
Instruction Fuzzy Hash: EE718CF3A082185FE3046D68DCD577AF7CDDB90720F1A863DE682C7744F979A8054296

Function 007D4A40 Relevance: 1.5, Strings: 1, Instructions: 220COMMON

Download Yara Rule

Strings

%*+(, xrefs: 007D4C33, 007D4C3B

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 0d36f221e2806c6f88443d83f65ece1cec7d87f882964d8f5f6facd8887325b0
Instruction ID: 75c5c3cf463c3d5e81ef5980a3ac66ea3be3c3e7f60174d030ea6e08e82b1af8
Opcode Fuzzy Hash: 0d36f221e2806c6f88443d83f65ece1cec7d87f882964d8f5f6facd8887325b0
Instruction Fuzzy Hash: 5661E0B56093419BD710DF25C880B2ABBF6EBD4314F28891EE5C98B391D739EC50CB66

Function 0079E1A0 Relevance: 1.4, Strings: 1, Instructions: 175COMMON

Download Yara Rule

Strings

000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F8081, xrefs: 0079E333

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID: 000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F8081
API String ID: 0-2471034898
Opcode ID: 1e0791e973886d85a9a5c41ffd670cc05950d430b52b11862aaa9e5aa9880131
Instruction ID: ee958606ede727ff3a4129882c95b09e5e62c9444ffb9d418997237f336c6c86
Opcode Fuzzy Hash: 1e0791e973886d85a9a5c41ffd670cc05950d430b52b11862aaa9e5aa9880131
Instruction Fuzzy Hash: FD513723A59A914BD728CA3CAC553A97B971BA3334B3DC76AE9F58B3E1D51D48048380

Function 007D3920 Relevance: 1.4, Strings: 1, Instructions: 172COMMON

Download Yara Rule

Strings

%*+(, xrefs: 007D39E3, 007D39EB

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 5e38fae66ae66a5e66212de879ea83a0cd83b1dfcfb6009968203ce342eaaa9d
Instruction ID: f73347b6e786eae185e769f757c52cfd8a71ce1f49abe3613e09a463e66d8660
Opcode Fuzzy Hash: 5e38fae66ae66a5e66212de879ea83a0cd83b1dfcfb6009968203ce342eaaa9d
Instruction Fuzzy Hash: DE519A746092409BCB249F14D990A2ABBF5EBC9708F18C81EF4CA87351D379EE10CB63

Function 0092BBB6 Relevance: 1.4, Strings: 1, Instructions: 159COMMON

Download Yara Rule

Strings

"N 0, xrefs: 0092BCA3

Memory Dump Source

Source File: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID: "N 0
API String ID: 0-3794144365
Opcode ID: eddebf4a80d45b5c61a9cf878f387c6c743341c4c237a158057063a66de5444d
Instruction ID: 044cfa5241a5b299fd7b0371e95481154838fe4ae553795a140d44f3b4ac85a3
Opcode Fuzzy Hash: eddebf4a80d45b5c61a9cf878f387c6c743341c4c237a158057063a66de5444d
Instruction Fuzzy Hash: EE4117F7609200AFF304AA1ADC81B7BF796EBD4760F16C63DD6C483A14EA754C058693

Function 007A1BEE Relevance: 1.4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

Strings

L3, xrefs: 007A1C3E

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID: L3
API String ID: 0-2730849248
Opcode ID: ee04df2d526f62809f4a7ee21399aad2dbe1078e88e3af58210640fd175269dc
Instruction ID: a07c609ec4896eb2a7add609c89bc4f09b7d5353ff3530f6c664f8757cfbca01
Opcode Fuzzy Hash: ee04df2d526f62809f4a7ee21399aad2dbe1078e88e3af58210640fd175269dc
Instruction Fuzzy Hash: 4E4154B41083809BD7149F14C894A2FBBF0BF8A314F449A1CF5C59B291E73AC915CB6A

Function 007CFF70 Relevance: 1.4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

Strings

%*+(, xrefs: 007D0033, 007D003B

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 0472543d11349691c51466574e14e45b0d64047a0cf55b3e18964f3c91971d5c
Instruction ID: 5ecd1ca3005b9e8240cf92f59f73f6b5f874ee47313eb731b0f3654ae5811042
Opcode Fuzzy Hash: 0472543d11349691c51466574e14e45b0d64047a0cf55b3e18964f3c91971d5c
Instruction Fuzzy Hash: F531F4B1908305BBD610EA14EC85F2BB7F9EB85748F54982AF98497352E239DC14C7A3

Function 007BE40C Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

72?1, xrefs: 007BE6A2

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID: 72?1
API String ID: 0-1649870076
Opcode ID: 606c7a8b4ecb286ca016755cdbb2973965db8c1c4f26fea922eac603645e9dce
Instruction ID: 3e8f158953c6f9f11ec2db7ee13fa8a9e9cc9822697cc7c692480287adddbf41
Opcode Fuzzy Hash: 606c7a8b4ecb286ca016755cdbb2973965db8c1c4f26fea922eac603645e9dce
Instruction Fuzzy Hash: 3231D5B5A01244CFCB20CF94E8C16EFB7B5FB0A344F94446CE446AB302D739A904CBA5

Function 007A6F91 Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

%*+(, xrefs: 007A703B

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 0d8bef308e706f4217eba5c9ab3d102de3cba3da6d6fad1d5b73885f4c8a5cad
Instruction ID: 65a58060cad1d8d947e93b27c9181ebe6e3621976ffc42fc6e46a4a00dd4d7a0
Opcode Fuzzy Hash: 0d8bef308e706f4217eba5c9ab3d102de3cba3da6d6fad1d5b73885f4c8a5cad
Instruction Fuzzy Hash: E4413875205B04DBD7288B61CD94B27B7F2FB8A705F148A18E5869B6A1E339E810CB64

Function 007BE66A Relevance: 1.4, Strings: 1, Instructions: 100COMMON

Download Yara Rule

Strings

72?1, xrefs: 007BE6A2

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID: 72?1
API String ID: 0-1649870076
Opcode ID: 4d67e48198c34569515ac5fd8d3006c50900d8cf36c5e41cb464e02fe94b72f2
Instruction ID: 05b294c1c6aea6219a1878d6a2ed3435220550dccf74812cd66d34d898f8f1f0
Opcode Fuzzy Hash: 4d67e48198c34569515ac5fd8d3006c50900d8cf36c5e41cb464e02fe94b72f2
Instruction Fuzzy Hash: 1521A375901244CFCB21CF95E9C16AFBBB5FB1A744F54485CE446AB342C739AD00CBA5

Function 007D9CE0 Relevance: 1.3, Strings: 1, Instructions: 87COMMON

Download Yara Rule

Strings

@, xrefs: 007D9D30

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: 12e02bb37b48443fd5c86a661dd4799fa870356b916efa02c6089e04acc529ee
Instruction ID: 039278d79f64d0b47c1d13bd32d645512c915370cbd5547c97e580e426adba94
Opcode Fuzzy Hash: 12e02bb37b48443fd5c86a661dd4799fa870356b916efa02c6089e04acc529ee
Instruction Fuzzy Hash: 5C3178706093409BD314DF14D880A2AFBFAFF9A318F14892DE6C897351D339D904CBA6

Function 007A4E2A Relevance: 1.0, Instructions: 957COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93ae5bfec804490b8d1f5b0806dd8cc9d0928212473ab9369e0da31697cb0329
Instruction ID: c815411a298b7a467f2cf352e686c012c39476e013ed534191b9d6b6e5424313
Opcode Fuzzy Hash: 93ae5bfec804490b8d1f5b0806dd8cc9d0928212473ab9369e0da31697cb0329
Instruction Fuzzy Hash: 85626BB0500B409FDB25CF24D994B27B7F6AF8A704F548A2CD49B87A52E739F804CB95

Function 0079BEB0 Relevance: .9, Instructions: 895COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30cb9a533554be97e06675d3460cdff0be9d55b2c6c1132c24f0b6137cc6b4a7
Instruction ID: 7d17c43bfcc6580f267e63363fb7933aff9cf3f5c64b12d63bd1ca369dbb3d36
Opcode Fuzzy Hash: 30cb9a533554be97e06675d3460cdff0be9d55b2c6c1132c24f0b6137cc6b4a7
Instruction Fuzzy Hash: 96520B316087118BCF26DF18E8402BAB3E1FFD5319F694A2DD9C697291D738A851CB86

Function 007D8652 Relevance: .7, Instructions: 710COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7050c352666f9fb66bd89ce17b7e3ba177fed342a747a2c61f3c8a44b2ba43d6
Instruction ID: 626cad9794e84300a4205b38c5c65897e79d97bc58be78045a87001889969003
Opcode Fuzzy Hash: 7050c352666f9fb66bd89ce17b7e3ba177fed342a747a2c61f3c8a44b2ba43d6
Instruction Fuzzy Hash: 2422CB35609385DFC704DF68E89062AB7F1FF8A315F09886EE5898B351D739E850CB46

Function 007D86F0 Relevance: .7, Instructions: 681COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8744f0006a37b5061c479f89c40060ae4ab669fd9730e4993c74edb0a686eb34
Instruction ID: efe397048d47f98574525dfc7cf1f93963130f327627b65e00254073ca7c3cf2
Opcode Fuzzy Hash: 8744f0006a37b5061c479f89c40060ae4ab669fd9730e4993c74edb0a686eb34
Instruction Fuzzy Hash: 4122CB35609380DFC704DF68E89062ABBF1FF8A315F09896EE5898B351D339E850CB46

Function 0079B3A0 Relevance: .7, Instructions: 670COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fa3a463d8d1513176232eceec6ac385a1a1078a54de1d5dcbf60d1fd5c84764
Instruction ID: b43a22fd74c0a7dd8c0ce10b19fb2e958960f50a309d4987e3de952fca4b07d0
Opcode Fuzzy Hash: 2fa3a463d8d1513176232eceec6ac385a1a1078a54de1d5dcbf60d1fd5c84764
Instruction Fuzzy Hash: BB52A370A08B848FEF35CB24E5847A7BBE2AF91314F144D2EC5E606B82D77DA885C751

Function 007971F0 Relevance: .7, Instructions: 657COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ac13de9b3f6a0b232a8eb1e9ed0572279bfb85b5900d6e296f34f76cdb642d3
Instruction ID: 0c348a4d98d81b4da535319f2fef9eed54b9ee5ab035862cbb6cf060e68f184d
Opcode Fuzzy Hash: 9ac13de9b3f6a0b232a8eb1e9ed0572279bfb85b5900d6e296f34f76cdb642d3
Instruction Fuzzy Hash: 3752C17151C3458FCB19CF28D0806AABBF1FF88314F198A6DE8995B352D778E949CB81

Function 00798FD0 Relevance: .6, Instructions: 620COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2d920bdccfa72a51a6963e36425da4c148d4df713d71ca285dc725417a4ed93
Instruction ID: f287d4ec65609e94cecce4e2ff3a0de5ee5e379298f9f9a7e49605218514dabc
Opcode Fuzzy Hash: a2d920bdccfa72a51a6963e36425da4c148d4df713d71ca285dc725417a4ed93
Instruction Fuzzy Hash: B0427675609341DFEB08CF28E85076ABBF1BB88315F09886DE5858B3A1D339D985CF42

Function 00797BF0 Relevance: .6, Instructions: 592COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d27d4cc0470d628c34009f04bd5f22945ce302cb87b5d775446730ee3bf46cd
Instruction ID: 09ae7f229fe368aa9a7d8d973319dcf8e1f12077fb267c6f70d36fec2d49731e
Opcode Fuzzy Hash: 8d27d4cc0470d628c34009f04bd5f22945ce302cb87b5d775446730ee3bf46cd
Instruction Fuzzy Hash: C1322470524B118FCB68CF29D59052AB7F2BF46710B604A2ED69787F91D73AF845CB10

Function 007D89A0 Relevance: .5, Instructions: 545COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f18888075732858848eddbd3bdbfe913e5003b3348c837fde4ccc0c30205ba48
Instruction ID: 2258bed92cf51bf05faab5e200e19e8b732e7c403dcc4af96543ed46621b56b1
Opcode Fuzzy Hash: f18888075732858848eddbd3bdbfe913e5003b3348c837fde4ccc0c30205ba48
Instruction Fuzzy Hash: 7A029A35609281DFC704DF68E88061ABBF5FF8A315F09896EE5C98B361D339D850CB96

Function 007D8A80 Relevance: .5, Instructions: 524COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da78b45583ef80ecf0467780f092cf94a42dc8619ae5be369d77b16c32fdd403
Instruction ID: 0126eec1e87f26d01e02d1bd7f6057aeece5a51fe2fdfb4133172e79c976bb20
Opcode Fuzzy Hash: da78b45583ef80ecf0467780f092cf94a42dc8619ae5be369d77b16c32fdd403
Instruction Fuzzy Hash: 98F18835609381DFC704DF68E88061AFBF5BB8A305F09896EE5C98B351D73AD910CB96

Function 007D8C02 Relevance: .5, Instructions: 487COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d30de6b88dfd43609e01e31c273447f221f17242d12a1638adc518aadd538db
Instruction ID: e1ef35906f1a5ef0ad81cf66cd296d4b8a69ddf0ea3ae90bf0252a182c2bd09d
Opcode Fuzzy Hash: 9d30de6b88dfd43609e01e31c273447f221f17242d12a1638adc518aadd538db
Instruction Fuzzy Hash: 11E1BF31609281CFC704DF28E88062AB7F5FB8A315F09896DE5D99B351D739E910CB96

Function 0079A300 Relevance: .5, Instructions: 459COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dbf8a9190905fd82ba4d34b3568b61c3c587483ba5650872ac470c2db95d517
Instruction ID: 399d77dcea101a4915e48bb307aca4f7fa3e034c09917d5a9c76981fc8126b81
Opcode Fuzzy Hash: 8dbf8a9190905fd82ba4d34b3568b61c3c587483ba5650872ac470c2db95d517
Instruction Fuzzy Hash: A3F1DF756093419FCB24CF29C881A6BFBE2AFD8300F48882DE4C587751E639E845CB92

Function 007D8E70 Relevance: .4, Instructions: 420COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3154c4956aeaa457c568bdfd910860563e130e00eb7d8055a390b57245b9dbfd
Instruction ID: bfad324e776ee65cacb0f2410e594b5e25e1b06fc78706af246e0470679ee7cd
Opcode Fuzzy Hash: 3154c4956aeaa457c568bdfd910860563e130e00eb7d8055a390b57245b9dbfd
Instruction Fuzzy Hash: 6BD17934609281DFD705EF28E88062ABBF5FB8A305F09896DE5C59B351D73AD810CB96

Function 007D7AB0 Relevance: .4, Instructions: 354COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d02229c4745771d87d8e31981931b98bb9ac7b6ff5d730473a042a6f43dbfa34
Instruction ID: a309af7a24cb74db00b065d2ff274f6b72287c537b278e82f545122deb024451
Opcode Fuzzy Hash: d02229c4745771d87d8e31981931b98bb9ac7b6ff5d730473a042a6f43dbfa34
Instruction Fuzzy Hash: 13B1F672A083508BD728DA28DC4576BB7F9EBC4314F48492EE9999B381F739DC04C792

Function 0079AF10 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c6117061885288c1b39a5b943f8482e52345fd8b1a48c2f17ef7dcb0cf10c7c
Instruction ID: bc1d2b7dd6579134f209eb13088c2f6fb0700809717b24cf1aef64f8ced0b326
Opcode Fuzzy Hash: 9c6117061885288c1b39a5b943f8482e52345fd8b1a48c2f17ef7dcb0cf10c7c
Instruction Fuzzy Hash: EEC18DB2A487418FC760CF68EC967ABB7E1FF85318F08492DD1D9C6242E778A155CB06

Function 007A6536 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 966cb67551921ac47005047b963683a18d03de3274b993a6495a24cc8e45e9db
Instruction ID: 84beaed2addc84e2cb029fc82ad47dd06e9977335a8cc942a0d99b63b24bcbf3
Opcode Fuzzy Hash: 966cb67551921ac47005047b963683a18d03de3274b993a6495a24cc8e45e9db
Instruction Fuzzy Hash: F6B101B4500B409BD321CF24D985B27BBF5EF86704F14895CE8AA8BB52E339F805CB55

Function 007D7710 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 62f0cdfffee9542263fd5e5a1d27fd3965ad0ffd2f70f45683f56e862abdefa8
Instruction ID: 1a2a4e7de46d121e23346f4eadc06b449f8ace8e2537409adeaa9f4a42f48ba9
Opcode Fuzzy Hash: 62f0cdfffee9542263fd5e5a1d27fd3965ad0ffd2f70f45683f56e862abdefa8
Instruction Fuzzy Hash: 2C91AE75A08341ABE728CB14C884B6FB7F5EB85354F94881EF58487351F738E950CB92

Function 007DA0D0 Relevance: .3, Instructions: 282COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7311d9fae77d89b7458a3c573bf39f49bd50c75504e075af062103a86f69b0ba
Instruction ID: 861b93f32ab80da568fd12d9ed3142d952fc58c515f16541f454956ca742277c
Opcode Fuzzy Hash: 7311d9fae77d89b7458a3c573bf39f49bd50c75504e075af062103a86f69b0ba
Instruction Fuzzy Hash: 6A819C34209705ABD724DF29C880A2AB7F5FF89744F55892EE586CB351E739EC10CB92

Function 007C64F0 Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 757af63ba5125e8be8b5bfd9be4e844361c0c57b77252b106828456b2deb6771
Instruction ID: b73e4fe1738d7be1f6a516365791ff5907bd29dc79538385bb49d127a6b9ebe1
Opcode Fuzzy Hash: 757af63ba5125e8be8b5bfd9be4e844361c0c57b77252b106828456b2deb6771
Instruction Fuzzy Hash: 0671D433B69A904BC314993C5C827A5AB934BD6334B3DC37EE9B49B3E5D62D88164340

Function 007B28E9 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10b00d24c60d1059049337f7caafc535c37bfcf15fea4ed7df9465a0b765d025
Instruction ID: 63b5cb927fb5956cacfbad5e1ffe7a9c2e5e7e4e9386cf7f21dedd27aa305689
Opcode Fuzzy Hash: 10b00d24c60d1059049337f7caafc535c37bfcf15fea4ed7df9465a0b765d025
Instruction Fuzzy Hash: BB6189B4409340DBD711AF14D881B6ABBF1FF96754F08891CF5C58B262E339D911CBAA

Function 007B7C00 Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81f226112c41bff3024205ac0cefe0caa24271b631d4a7773cf198a5c500b038
Instruction ID: b6f6cc61bffcf9500da65435071a6e0e0cb080ba61ee2472e61bbd6c950b7470
Opcode Fuzzy Hash: 81f226112c41bff3024205ac0cefe0caa24271b631d4a7773cf198a5c500b038
Instruction Fuzzy Hash: C051B0B17082049BDB249B24CC96BB737B8EF85764F148958F9858B391F379D801C761

Function 007C1860 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d108e008403b3c92b59985e25fae4eb0cb21936506a5ffd7efe5999b9cc5533
Instruction ID: 6a6f720769509b4f2d5f5ad10373eb441f3936085e915adc97744d9d726c49f8
Opcode Fuzzy Hash: 6d108e008403b3c92b59985e25fae4eb0cb21936506a5ffd7efe5999b9cc5533
Instruction Fuzzy Hash: 1561CF3160D3519FD714CE29C580B2FBBE2ABCA350FA4C93EE4898B352D278ED859741

Function 007C82D0 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 687783bd8ef0da0df7970b958b3822f24c8644fa48ea92460181c34f2a9da7f5
Instruction ID: 95bfc7ff87ab7e01147d76d36618aa0d4f4f19e64a135092cc43b76f1b470cb9
Opcode Fuzzy Hash: 687783bd8ef0da0df7970b958b3822f24c8644fa48ea92460181c34f2a9da7f5
Instruction Fuzzy Hash: B5612833A5A9D18BC359493C5C557AAAB831BD2730F3EC36ED9B18B3E5CD6D48028342

Function 008BFC66 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2153a0cf81e6988f9bf9d24048da97d3905359773e218042527c03ec12053710
Instruction ID: db17da9041b33176f92d4b91882747dd22154f9159151c7f14c7576310c15d9e
Opcode Fuzzy Hash: 2153a0cf81e6988f9bf9d24048da97d3905359773e218042527c03ec12053710
Instruction Fuzzy Hash: 466120F3E083145BE304AA7DDC8576AB7D9EF94320F1A853DEA84D3B44E9785D098392

Function 007A42FC Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df7915acf5ba94d3857383ab0420c1f69b77587e58a584d8e63a6eb026295dcf
Instruction ID: 199c10436a03123c4e152e871d4f450fd0e6277b547bade7d00046efd36a6efc
Opcode Fuzzy Hash: df7915acf5ba94d3857383ab0420c1f69b77587e58a584d8e63a6eb026295dcf
Instruction Fuzzy Hash: 0381FFB4810B00AFD360EF38D94B797BEF4AB06301F404A1DE4EA96695E7356419CBE3

Function 008D4390 Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 524c7343836c172f3bcda548677690bc8976826cc345ab814ee4aa2531a4d42b
Instruction ID: 12693bc9e3825af03bb9830201c8987b535acb07fdae6035f05731d112f8c819
Opcode Fuzzy Hash: 524c7343836c172f3bcda548677690bc8976826cc345ab814ee4aa2531a4d42b
Instruction Fuzzy Hash: FD5169F3A092049FE3046E2DED4837ABBD5EBC4320F2B053CEAC583744E97958458657

Function 007CE8A0 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53adb1b22930f8a695f789fdc3f4b943ccd6ac5fb5c634955e3c1cdf4e3fec6a
Instruction ID: fe78f731914d21e910dde311a81d54cca1b15092083f8aebd25353b7fd1ed0cc
Opcode Fuzzy Hash: 53adb1b22930f8a695f789fdc3f4b943ccd6ac5fb5c634955e3c1cdf4e3fec6a
Instruction Fuzzy Hash: A7516CB16087548FE314DF69D49476BBBE1BBC9318F044E2DE4E987350E379DA088B82

Function 007D7520 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e33045ff53e5a5c7366e7030c3c1c5d4014c7602aeb72f06a509822e9bbfa92
Instruction ID: 4e1ba035ffe0934b7cd043734e609882d9b631e6c92260b455e6823be1f84e4d
Opcode Fuzzy Hash: 9e33045ff53e5a5c7366e7030c3c1c5d4014c7602aeb72f06a509822e9bbfa92
Instruction Fuzzy Hash: 92512B7160C2109BC7189E18DC90B2EB7F6FB89329F288A2DE9D557391E739EC10C751

Function 00795A50 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cb51e7a58851f938e35384b67957c51a4979adb0ff62e04d17843235b223d55
Instruction ID: fe8cc6bc9f4f4dcc3ae427cc143ab24296e0f5dc27d22244f6e719be82f641a4
Opcode Fuzzy Hash: 6cb51e7a58851f938e35384b67957c51a4979adb0ff62e04d17843235b223d55
Instruction Fuzzy Hash: 6B5103B0A047159FCB16DF14E880926B7E0FF85324F59866CF8998B342D639EC42CB96

Function 0085E589 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 860a587af5223ff8f2e21d6e992f7e4d7b956d446074f6a7b05d1a474e3fe88b
Instruction ID: 1ebf51b1301860a98099eabe488b90eff250b6f5cdcc0c878ff4ac0beb1bbed3
Opcode Fuzzy Hash: 860a587af5223ff8f2e21d6e992f7e4d7b956d446074f6a7b05d1a474e3fe88b
Instruction Fuzzy Hash: E851E1F36086045FE308AE2EDC8536AB7E6EFD4710F06853DDBC583380EA3558058686

Function 009B8055 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0da9d0af70fa40bb0d56d0d8123142a3d7e14fd105428a9a9cba92839926db2a
Instruction ID: 578b1cf05eb024d2fde192afaeeb1c711dbfcb2ff352ecb26d82e5602a073f93
Opcode Fuzzy Hash: 0da9d0af70fa40bb0d56d0d8123142a3d7e14fd105428a9a9cba92839926db2a
Instruction Fuzzy Hash: 7E419AF251D500DFD709AE18DA416BBBBE9EB4C320F260D2DE9C6D3240EA395851DB83

Function 007BEC48 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f69c2320bdfbd2536c9cce21c23542930ee732e775181adde1fa4ae2ff34a3c5
Instruction ID: f6d00a344543ca245e39f1cf99de2505faec848a0b879070adbf2ae35b47a1f7
Opcode Fuzzy Hash: f69c2320bdfbd2536c9cce21c23542930ee732e775181adde1fa4ae2ff34a3c5
Instruction Fuzzy Hash: 59419D78A00315DBDF208F94DC91BEDB7B0FF0A300F544548E945AB3A1EB78A951CBA5

Function 007D9B60 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ff6aa12452d4bcec24171ee1d5f32d478d9541c3d8d96e97a81ab7db59d3c86
Instruction ID: 254cb1ec0cb0eeebb7db6de7e8d0d9863d62d4714973c87d2180cc738b63bf70
Opcode Fuzzy Hash: 4ff6aa12452d4bcec24171ee1d5f32d478d9541c3d8d96e97a81ab7db59d3c86
Instruction Fuzzy Hash: 2E41AE74218340ABD710DB24D990B2BBBF6EB85714F14882EF6C99B351D339E810CB66

Function 007A2030 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0124e97d00fddbff92d435a7d590341e12187a90ad18d87683eee3d21ddfc5da
Instruction ID: e5d6bd7c0a52ff4b641414b745200793935e1639471333dba3af3d38f1b93895
Opcode Fuzzy Hash: 0124e97d00fddbff92d435a7d590341e12187a90ad18d87683eee3d21ddfc5da
Instruction Fuzzy Hash: 1341D572A083654FD35DCE29C49063ABBE2ABC5300F09C66EE4D68B3D5DA788945DB81

Function 007A1E93 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc4cada2c31d15886c7de6a3ac0260f1a30d3836d8b60e61e4db334991c23ec4
Instruction ID: 5ca643d80333d9872cccd063cb1b457dd6d8b82ab52c01951d6f0d59d08bed85
Opcode Fuzzy Hash: bc4cada2c31d15886c7de6a3ac0260f1a30d3836d8b60e61e4db334991c23ec4
Instruction Fuzzy Hash: 5C41E17450D380ABD320AB58C888B1EFBF5FB87355F544A1DF6C497292C37AD8148B66

Function 007D8D8A Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de3a914d287ac77a3739bde914007288bf04e1aece69954d553a51e134869dde
Instruction ID: 1c8dbd681a1c81138c2ebff95706403192ebbf3259c373bea40aa85cd7ec3db7
Opcode Fuzzy Hash: de3a914d287ac77a3739bde914007288bf04e1aece69954d553a51e134869dde
Instruction Fuzzy Hash: 6A41C0316082508FC344DF68C49052EFBF6AF99300F098A5ED4D9973A2DB78DD018B92

Function 007AD961 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 330c0c3f3ad2a96e5afdd4eead1730c1f122ef6b55488e1c35d425af30499144
Instruction ID: 75b1fd70e055aacff9acc4eb0fd48fa9645d5f6e1592ced8c19659f0435ffa38
Opcode Fuzzy Hash: 330c0c3f3ad2a96e5afdd4eead1730c1f122ef6b55488e1c35d425af30499144
Instruction Fuzzy Hash: F3419FB1609381CBD7309F14C885BABB7B0FF9B354F048959E48A8BB91E7785940CB97

Function 007CF030 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5be6113664422e96713363ec41851647c31506b086c17a8b3ff98e201e465e1
Instruction ID: d4011fe5501d067d3b6662985cc7cbfebc2e20922e53b7c838e60832905466e0
Opcode Fuzzy Hash: c5be6113664422e96713363ec41851647c31506b086c17a8b3ff98e201e465e1
Instruction Fuzzy Hash: 9F2129329082244BC3249B5DC481A3BF7E5EB99B05F16C63ED9C4A7296E339DC54C7E2

Function 007D67EF Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1824b788c9d38c8434e0f07b9245391b5b562cd1fc286f23888642d09791de33
Instruction ID: 03e511348bafc504bdf72b38417a3023a50147418734b6917a35571f533a48e3
Opcode Fuzzy Hash: 1824b788c9d38c8434e0f07b9245391b5b562cd1fc286f23888642d09791de33
Instruction Fuzzy Hash: 7631077051C3829AD714CF14C49062FBBF0EF96789F54590DF4C8AB262E338E985DB9A

Function 007B5E70 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a29ff515a1c197ce77cdd26c4873eb69d9acb1592c4b1f170424154f39b4907
Instruction ID: 179f06b01eb7c2f5a0c5daeb5ee2268693be3e671b801fa595dd60a457861e0e
Opcode Fuzzy Hash: 2a29ff515a1c197ce77cdd26c4873eb69d9acb1592c4b1f170424154f39b4907
Instruction Fuzzy Hash: 12219C70509201DBC311AF28C845ABBF7F4EF96764F448908F4D99B292E338DA00CBA2

Function 007949A0 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbe2eee255ce80e2df90ed4850d7395439c2c852be5922ee4a7cea5853ec6c97
Instruction ID: 8ea768ec6699e18cf734a1e9dde2c17548f84009691053e4b62aeeecc706fa7a
Opcode Fuzzy Hash: cbe2eee255ce80e2df90ed4850d7395439c2c852be5922ee4a7cea5853ec6c97
Instruction Fuzzy Hash: 4031EA316582009BDF149E28F885D2BB7F1EF85358F18C96CE89A97241D239DC43CB46

Function 007D64B8 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb23d229f3ef7980de263974b42c62c0931417649a0766adb9ef1a5bf8947150
Instruction ID: 8c5122aba72faf41e13aa476b96c58909fbb1944b5d08efa3e52634592cdd080
Opcode Fuzzy Hash: eb23d229f3ef7980de263974b42c62c0931417649a0766adb9ef1a5bf8947150
Instruction Fuzzy Hash: 4B21397450D280DBC704EF19D580A2EFBF6EB99745F18881DE4C597362D339A850CB66

Function 007CB650 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: a84fc93ad8d74cec18aa38833db5eb9a407817f78d92e3f007413742316628ac
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 32118233A051D84EC3168D3CC441A65BFA31AA3735F59839DF4F8AB2D2D7268D8A8365

Function 007C0B80 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90022ddfb32469098a8610d4b68e70bc315f5b0e8987f5b71d64abe4c0da561b
Instruction ID: 25afc9e82e9cc2f31ad884ac21ab9bea4a077a874c8fd657bf020473d32c32e7
Opcode Fuzzy Hash: 90022ddfb32469098a8610d4b68e70bc315f5b0e8987f5b71d64abe4c0da561b
Instruction Fuzzy Hash: E70171F5A00302C7EB21DE54A8D5F3BB3A9AF80718F18452CE81A57202DB7AEC05C6E5

Function 007BD1E1 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f88dae88c162b486723c9c130650d25f04fb661a413d634af873e7692d258cb8
Instruction ID: 635fba9ce3c04ba10f1e5d1a258ead67ebfc43d7be17fdf92e44800ddca1f063
Opcode Fuzzy Hash: f88dae88c162b486723c9c130650d25f04fb661a413d634af873e7692d258cb8
Instruction Fuzzy Hash: C011DDB0408380EFD3209F61C488A1FFBE5AB96714F148C0DE5A49B251D379D815CB56

Function 00796EA0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fb9c517c06e59fcbf96a1ecd975798aa29084f6469d67761d9e288ca262d780
Instruction ID: 133a53ce6b4cc7b650dc140f82cebe98426c67e2849b4b69afab74bfcd2d7f0e
Opcode Fuzzy Hash: 5fb9c517c06e59fcbf96a1ecd975798aa29084f6469d67761d9e288ca262d780
Instruction Fuzzy Hash: 44F0243A72920A0BA610DDAAB8C083BB3E7E7C9354B055639EA44D3201CD76E80681A4

Function 007CB8C0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dad40b8a8b0cf0c680be38028a9801f4e1e9da1297b4f3b9e1d9df466e9bee7e
Instruction ID: 6506d07c58c905065930edc77b6421f51c28c54387ea28b09faa2761b04cb969
Opcode Fuzzy Hash: dad40b8a8b0cf0c680be38028a9801f4e1e9da1297b4f3b9e1d9df466e9bee7e
Instruction Fuzzy Hash: 1E0162B3A199610B8348CE3DDC1156BBAD15BD5770F19872DBEF5CB3E0D230C8118695

Function 007AC5F0 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8ebd7708255391ffa87ed53dd5dbf97c7cff7b52fcdad9dabb06971c835301f
Instruction ID: afd6f86e1ed7dc578beff9a6215ab27dc393fb41cabbec3b70aacfa27007612f
Opcode Fuzzy Hash: d8ebd7708255391ffa87ed53dd5dbf97c7cff7b52fcdad9dabb06971c835301f
Instruction Fuzzy Hash: EB014B72A196204B8308CE3C9C1112ABEE19B86330F158B2EBCFAD73E0D664CD548696

Function 007AB410 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 809ee23363f840c811a801533be2b64f834fb93f4c5a4ab9cc37b5a2fd812bb4
Instruction ID: 50b696deb7a7387f4451b84804b82261218474b8d31354835fbd13d4351e9753
Opcode Fuzzy Hash: 809ee23363f840c811a801533be2b64f834fb93f4c5a4ab9cc37b5a2fd812bb4
Instruction Fuzzy Hash: 83F0ECB160455057DF268A549CC0F37BB9CCBCF354F190626EC4557103E2655C45C3E5

Function 007C8220 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09d9c3fe2d407b74b6b4da7b538ae1f8f19a4853ba2efe725027fa45717d9ee1
Instruction ID: a359bd51a222475851944c784633cce066a7abd7bd130ea4539f482fb7d5852d
Opcode Fuzzy Hash: 09d9c3fe2d407b74b6b4da7b538ae1f8f19a4853ba2efe725027fa45717d9ee1
Instruction Fuzzy Hash: C701E4B04107019FC360EF29C445757BBF8EB09714F008A1DE8AECB790D774A544CB82

Function 007D1440 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction ID: d6eca1e39768c7c26a04402f3324f2f8875575f020b97038ccd2242409939dee
Opcode Fuzzy Hash: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction Fuzzy Hash: 3BD0A77160836156AF748E19A4109B7F7F0EAC7B11F89955FF986E324CD234DC41C2A9

Function 007A1ACD Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 895ac269430ecb7b1a965961106fbece0a4cf4e9bf35b32b3fa3e7cb5c838ff2
Instruction ID: c44827953a0829b78663592d588b41d09f1c078f54eaa9769e1c322fe44319ce
Opcode Fuzzy Hash: 895ac269430ecb7b1a965961106fbece0a4cf4e9bf35b32b3fa3e7cb5c838ff2
Instruction Fuzzy Hash: 2CC01234A5A0808B82049F00A899432A3B8A34B208B40E02BDA03E7261CA68C402890E

Function 007D6094 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cc9b4a0040e68f84ce46902f29d8a68ec20cb0f3fb5cf15fbab6a4d8caaeb12
Instruction ID: 1a180db05030cf71d73c77cd95dea000396cd795e5e604264a2a3a0430a5b09f
Opcode Fuzzy Hash: 4cc9b4a0040e68f84ce46902f29d8a68ec20cb0f3fb5cf15fbab6a4d8caaeb12
Instruction Fuzzy Hash: C6C04C7465D04087A108CF049995475E2769A9B614628F01AC8072B255D128D512951C

Function 007A1A3C Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba7c1dfe828e8fabcd06326c95632b1457e7a69ed5316931f3f935a99d670543
Instruction ID: 1a8f2beab103418edc65eba84ede95eb1dfc35150e92e3a147d493e5807a85ea
Opcode Fuzzy Hash: ba7c1dfe828e8fabcd06326c95632b1457e7a69ed5316931f3f935a99d670543
Instruction Fuzzy Hash: 42C09B35A9A080CBD244DF85E9D1431A3FD5347208B50F03BD703F7261C564D405850D

Function 007D5FD6 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2173641449.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2173623737.0000000000790000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173674838.00000000007F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173690640.00000000007FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174070309.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174094158.0000000000949000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174115509.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174153533.000000000096B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174231515.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174529515.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174773872.0000000000981000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174800190.0000000000998000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174843092.00000000009AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174865163.00000000009CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174887886.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174905036.00000000009D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174926579.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174956131.00000000009EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174976185.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174992857.00000000009EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175012197.00000000009F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175032845.00000000009F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175059043.00000000009F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175077687.00000000009FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175095964.0000000000A04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175109647.0000000000A05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175124930.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175146135.0000000000A0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175161077.0000000000A0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175186557.0000000000A2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175205625.0000000000A4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175258381.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175277304.0000000000A81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175328139.0000000000A90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175344482.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bcf487768a1ab9b41e55b5da91d3f14189311013dcbf9857522ff1c35b96a2f
Instruction ID: 00f2e516cf75c656de3ac1d988bb68d7d86ccfafb270f89cb9cc503a611aa868
Opcode Fuzzy Hash: 8bcf487768a1ab9b41e55b5da91d3f14189311013dcbf9857522ff1c35b96a2f
Instruction Fuzzy Hash: 42C09274B6A0808BB24CCF18DD95935F2BB9B8FA18B14F02DC807AB256E138D512860C

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Boot Survival

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Windows Analysis Report
file.exe

Function 0079FCA0 Relevance: 5.4, Strings: 4, Instructions: 373
COMMON

Function 0079D110 Relevance: 1.7, APIs: 1, Instructions: 168
COMMON

Function 007D5700 Relevance: 1.6, APIs: 1, Instructions: 69
memoryCOMMON

Function 007D5BB0 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Function 007D695B Relevance: 1.4, Strings: 1, Instructions: 100
COMMON

Function 007A049B Relevance: .3, Instructions: 264
COMMON

Function 007A0228 Relevance: .2, Instructions: 218
COMMON

Function 007D3220 Relevance: 1.6, APIs: 1, Instructions: 59
memoryCOMMON

Function 007D3202 Relevance: 1.5, APIs: 1, Instructions: 6
memoryCOMMON